Merge inbound to m-c. a=merge

addon-sdk/mach_commands.py

@@ -26,7 +26,7 @@ class JetpackRunner(MozbuildObject):
 @CommandProvider
 class MachCommands(MachCommandBase):
     @Command('jetpack-test', category='testing',
-        description='Runs the jetpack test suite.')
+        description='Runs the jetpack test suite (Add-on SDK).')
     def run_jetpack_test(self, **params):
         # We should probably have a utility function to ensure the tree is
         # ready to run tests. Until then, we just create the state dir (in

build/valgrind/mach_commands.py

@@ -35,7 +35,7 @@ class MachCommands(MachCommandBase):
 
     @Command('valgrind-test', category='testing',
         conditions=[conditions.is_firefox, is_valgrind_build],
-        description='Run the Valgrind test job.')
+        description='Run the Valgrind test job (memory-related errors).')
     @CommandArgument('--suppressions', default=[], action='append',
         metavar='FILENAME',
         help='Specify a suppression file for Valgrind to use. Use '

config/external/icu/moz.build

@@ -9,10 +9,10 @@ LIBRARY_NAME = 'icu'
 if CONFIG['MOZ_NATIVE_ICU']:
     OS_LIBS += CONFIG['MOZ_ICU_LIBS']
 else:
-    USE_LIBS += sorted(
+    # Order needs to be preserved
-        '%s/intl/icu/target/lib/%s%s' % (
+    for l in CONFIG['ICU_LIB_NAMES']:
+        USE_LIBS += ['%s/intl/icu/target/lib/%s%s' % (
             'static:' if not CONFIG['MOZ_SHARED_ICU'] else '',
             l,
             CONFIG['MOZ_ICU_DBG_SUFFIX']
-        ) for l in CONFIG['ICU_LIB_NAMES']
+        )]
-    )

configure.in

@@ -3817,6 +3817,7 @@ MOZ_SAFE_BROWSING=
 MOZ_HELP_VIEWER=
 MOZ_SPELLCHECK=1
 MOZ_ANDROID_OMTC=
+MOZ_ANDROID_APZ=
 MOZ_TOOLKIT_SEARCH=1
 MOZ_UI_LOCALE=en-US
 MOZ_UNIVERSALCHARDET=1
@@ -4819,6 +4820,18 @@ if test -n "$MOZ_ANDROID_OMTC"; then
      AC_DEFINE(MOZ_ANDROID_OMTC)
 fi
 
+dnl ========================================================
+dnl = Enable the C++ async pan/zoom code instead of the Java version
+dnl ========================================================
+MOZ_ARG_ENABLE_BOOL(android-apz,
+[  --enable-android-apz      Switch to C++ pan/zoom code],
+    MOZ_ANDROID_APZ=1,
+    MOZ_ANDROID_APZ=)
+if test -n "$MOZ_ANDROID_APZ"; then
+     dnl Do this if defined in confvars.sh
+     AC_DEFINE(MOZ_ANDROID_APZ)
+fi
+
 dnl ========================================================
 dnl = Disable WebSMS backend
 dnl ========================================================
@@ -8397,6 +8410,7 @@ AC_SUBST(MOZ_UNIVERSALCHARDET)
 AC_SUBST(ACCESSIBILITY)
 AC_SUBST(MOZ_SPELLCHECK)
 AC_SUBST(MOZ_ANDROID_OMTC)
+AC_SUBST(MOZ_ANDROID_APZ)
 AC_SUBST(MOZ_ANDROID_ANR_REPORTER)
 AC_SUBST(MOZ_CRASHREPORTER)
 AC_SUBST(MOZ_CRASHREPORTER_INJECTOR)

content/base/src/ThirdPartyUtil.cpp

@@ -32,7 +32,7 @@ ThirdPartyUtil::IsThirdPartyInternal(const nsCString& aFirstDomain,
                                      nsIURI* aSecondURI,
                                      bool* aResult)
 {
-  NS_ASSERTION(aSecondURI, "null URI!");
+  NS_ENSURE_ARG(aSecondURI);
 
   // Get the base domain for aSecondURI.
   nsCString secondDomain;
@@ -46,18 +46,23 @@ ThirdPartyUtil::IsThirdPartyInternal(const nsCString& aFirstDomain,
 }
 
 // Get the URI associated with a window.
-already_AddRefed<nsIURI>
+NS_IMETHODIMP
-ThirdPartyUtil::GetURIFromWindow(nsIDOMWindow* aWin)
+ThirdPartyUtil::GetURIFromWindow(nsIDOMWindow* aWin, nsIURI** result)
 {
+  nsresult rv;
   nsCOMPtr<nsIScriptObjectPrincipal> scriptObjPrin = do_QueryInterface(aWin);
-  NS_ENSURE_TRUE(scriptObjPrin, nullptr);
+  if (!scriptObjPrin) {
+    return NS_ERROR_INVALID_ARG;
+  }
 
   nsIPrincipal* prin = scriptObjPrin->GetPrincipal();
-  NS_ENSURE_TRUE(prin, nullptr);
+  if (!prin) {
+    return NS_ERROR_INVALID_ARG;
+  }
 
-  nsCOMPtr<nsIURI> result;
+  nsCOMPtr<nsIURI> uri;
-  prin->GetURI(getter_AddRefs(result));
+  rv = prin->GetURI(result);
-  return result.forget();
+  return rv;
 }
 
 // Determine if aFirstURI is third party with respect to aSecondURI. See docs
@@ -92,11 +97,13 @@ ThirdPartyUtil::IsThirdPartyWindow(nsIDOMWindow* aWindow,
   bool result;
 
   // Get the URI of the window, and its base domain.
-  nsCOMPtr<nsIURI> currentURI = GetURIFromWindow(aWindow);
+  nsresult rv;
-  NS_ENSURE_TRUE(currentURI, NS_ERROR_INVALID_ARG);
+  nsCOMPtr<nsIURI> currentURI;
+  rv = GetURIFromWindow(aWindow, getter_AddRefs(currentURI));
+  NS_ENSURE_SUCCESS(rv, rv);
 
   nsCString bottomDomain;
-  nsresult rv = GetBaseDomain(currentURI, bottomDomain);
+  rv = GetBaseDomain(currentURI, bottomDomain);
   if (NS_FAILED(rv))
     return rv;
 
@@ -126,8 +133,8 @@ ThirdPartyUtil::IsThirdPartyWindow(nsIDOMWindow* aWindow,
       return NS_OK;
     }
 
-    parentURI = GetURIFromWindow(parent);
+    rv = GetURIFromWindow(parent, getter_AddRefs(parentURI));
-    NS_ENSURE_TRUE(parentURI, NS_ERROR_INVALID_ARG);
+    NS_ENSURE_SUCCESS(rv, rv);
 
     rv = IsThirdPartyInternal(bottomDomain, parentURI, &result);
     if (NS_FAILED(rv))
@@ -247,6 +254,29 @@ ThirdPartyUtil::IsThirdPartyChannel(nsIChannel* aChannel,
   return IsThirdPartyWindow(ourWin, channelURI, aResult);
 }
 
+NS_IMETHODIMP
+ThirdPartyUtil::GetTopWindowForChannel(nsIChannel* aChannel, nsIDOMWindow** aWin)
+{
+  NS_ENSURE_ARG(aWin);
+
+  nsresult rv;
+  // Find the associated window and its parent window.
+  nsCOMPtr<nsILoadContext> ctx;
+  NS_QueryNotificationCallbacks(aChannel, ctx);
+  if (!ctx) {
+    return NS_ERROR_INVALID_ARG;
+  }
+
+  nsCOMPtr<nsIDOMWindow> window;
+  rv = ctx->GetAssociatedWindow(getter_AddRefs(window));
+  if (!window) {
+    return NS_ERROR_INVALID_ARG;
+  }
+
+  rv = window->GetTop(aWin);
+  return rv;
+}
+
 // Get the base domain for aHostURI; e.g. for "www.bbc.co.uk", this would be
 // "bbc.co.uk". Only properly-formed URI's are tolerated, though a trailing
 // dot may be present. If aHostURI is an IP address, an alias such as

content/base/src/ThirdPartyUtil.h

@@ -28,7 +28,6 @@ private:
 
   nsresult IsThirdPartyInternal(const nsCString& aFirstDomain,
     nsIURI* aSecondURI, bool* aResult);
-  static already_AddRefed<nsIURI> GetURIFromWindow(nsIDOMWindow* aWin);
 
   nsCOMPtr<nsIEffectiveTLDService> mTLDService;
 };

content/base/src/nsObjectLoadingContent.cpp

@@ -989,6 +989,17 @@ nsObjectLoadingContent::OnStopRequest(nsIRequest *aRequest,
   PROFILER_LABEL("nsObjectLoadingContent", "OnStopRequest",
     js::ProfileEntry::Category::NETWORK);
 
+  // Handle object not loading error because source was a tracking URL.
+  // We make a note of this object node by including it in a dedicated
+  // array of blocked tracking nodes under its parent document.
+  if (aStatusCode == NS_ERROR_TRACKING_URI) {
+    nsCOMPtr<nsIContent> thisNode =
+      do_QueryInterface(static_cast<nsIObjectLoadingContent*>(this));
+    if (thisNode) {
+      thisNode->GetCurrentDoc()->AddBlockedTrackingNode(thisNode);
+    }
+  }
+
   NS_ENSURE_TRUE(nsContentUtils::IsCallerChrome(), NS_ERROR_NOT_AVAILABLE);
 
   if (aRequest != mChannel) {

dom/base/URLSearchParams.cpp

@@ -181,30 +181,29 @@ URLSearchParams::ConvertString(const nsACString& aInput, nsAString& aOutput)
     }
   }
 
-  nsACString::const_iterator iter;
-  aInput.BeginReading(iter);
-
   int32_t inputLength = aInput.Length();
   int32_t outputLength = 0;
 
-  nsresult rv = mDecoder->GetMaxLength(iter.get(), inputLength,
+  nsresult rv = mDecoder->GetMaxLength(aInput.BeginReading(), inputLength,
                                        &outputLength);
   if (NS_WARN_IF(NS_FAILED(rv))) {
     return;
   }
 
-  const mozilla::fallible_t fallible = mozilla::fallible_t();
+  if (!aOutput.SetLength(outputLength, fallible_t())) {
-  nsAutoArrayPtr<char16_t> buf(new (fallible) char16_t[outputLength + 1]);
-  if (!buf) {
     return;
   }
 
-  rv = mDecoder->Convert(iter.get(), &inputLength, buf, &outputLength);
+  int32_t newOutputLength = outputLength;
-  if (NS_SUCCEEDED(rv)) {
+  rv = mDecoder->Convert(aInput.BeginReading(), &inputLength,
-    buf[outputLength] = 0;
+                         aOutput.BeginWriting(), &newOutputLength);
-    if (!aOutput.Assign(buf, outputLength, mozilla::fallible_t())) {
+  if (NS_FAILED(rv)) {
-      aOutput.Truncate();
+    aOutput.Truncate();
-    }
+    return;
+  }
+
+  if (newOutputLength < outputLength) {
+    aOutput.Truncate(newOutputLength);
   }
 }
 

dom/bindings/mach_commands.py

@@ -30,7 +30,7 @@ class WebIDLProvider(MachCommandBase):
             manager.generate_example_files(i)
 
     @Command('webidl-parser-test', category='testing',
-        description='Run WebIDL tests.')
+        description='Run WebIDL tests (Interface Browser parser).')
     @CommandArgument('--verbose', '-v', action='store_true',
         help='Run tests in verbose mode.')
     def webidl_test(self, verbose=False):

dom/ipc/CrashReporterParent.cpp

@@ -168,21 +168,31 @@ CrashReporterParent::NotifyCrashService()
         return;
     }
 
-    if (mProcessType == GeckoProcessType_Content) {
+    int32_t processType;
-        crashService->AddCrash(nsICrashService::PROCESS_TYPE_CONTENT,
+    int32_t crashType = nsICrashService::CRASH_TYPE_CRASH;
-                               nsICrashService::CRASH_TYPE_CRASH,
+
-                               mChildDumpID);
+    switch (mProcessType) {
-    }
+        case GeckoProcessType_Content:
-    else if (mProcessType == GeckoProcessType_Plugin) {
+            processType = nsICrashService::PROCESS_TYPE_CONTENT;
-        nsAutoCString val;
+            break;
-        int32_t crashType = nsICrashService::CRASH_TYPE_CRASH;
+        case GeckoProcessType_Plugin: {
-        if (mNotes.Get(NS_LITERAL_CSTRING("PluginHang"), &val) &&
+            processType = nsICrashService::PROCESS_TYPE_PLUGIN;
-            val.Equals(NS_LITERAL_CSTRING("1"))) {
+            nsAutoCString val;
-            crashType = nsICrashService::CRASH_TYPE_HANG;
+            if (mNotes.Get(NS_LITERAL_CSTRING("PluginHang"), &val) &&
+                val.Equals(NS_LITERAL_CSTRING("1"))) {
+                crashType = nsICrashService::CRASH_TYPE_HANG;
+            }
+            break;
         }
-        crashService->AddCrash(nsICrashService::PROCESS_TYPE_PLUGIN, crashType,
+        case GeckoProcessType_GMPlugin:
-                               mChildDumpID);
+            processType = nsICrashService::PROCESS_TYPE_GMPLUGIN;
+            break;
+        default:
+            NS_ERROR("unknown process type");
+            return;
     }
+
+    crashService->AddCrash(processType, crashType, mChildDumpID);
 }
 #endif
 

dom/media/tests/mochitest/long.js

@@ -59,6 +59,10 @@ function outputPcStats(stats, label) {
 
 
 var _lastStats = {};
+
+const MAX_ERROR_CYCLES = 5;
+var _errorCount = {};
+
 /**
  * Verifies the peer connection stats interval over interval
  *
@@ -81,11 +85,18 @@ function verifyPcStats(stats, label) {
   ];
 
   if (_lastStats[label] !== undefined) {
+    var errorsInCycle = false;
+
     function verifyIncrease(rtpName, statNames) {
       var timestamp = new Date(stats[rtpName].timestamp).toISOString();
 
       statNames.forEach(function (statName) {
-        ok(stats[rtpName][statName] > _lastStats[label][rtpName][statName],
+        var passed = stats[rtpName][statName] >
+            _lastStats[label][rtpName][statName];
+        if (!passed) {
+          errorsInCycle = true;
+        }
+        ok(passed,
            timestamp + '.' + label + '.' + rtpName + '.' + statName,
            label + '.' + rtpName + '.' + statName + ' increased (value=' +
            stats[rtpName][statName] + ')');
@@ -101,8 +112,21 @@ function verifyPcStats(stats, label) {
         }
       }
     }
+
+    if (errorsInCycle) {
+      _errorCount[label] += 1;
+      info(label +": increased error counter to " + _errorCount[label]);
+    } else {
+      // looks like we recovered from a temp glitch
+      if (_errorCount[label] > 0) {
+        info(label + ": reseting error counter to zero");
+      }
+      _errorCount[label] = 0;
+    }
+  } else {
+    _errorCount[label] = 0;
   }
-  
+
   _lastStats[label] = stats;
 }
 
@@ -175,8 +199,16 @@ function generateIntervalCommand(callback, interval, duration, name) {
           callback(test);
         }
 
+        var failed = false;
+        Object.keys(_errorCount).forEach(function (label) {
+          if (_errorCount[label] > MAX_ERROR_CYCLES) {
+            ok(false, "Encountered more then " + MAX_ERROR_CYCLES + " cycles" +
+              " with errors on " + label);
+            failed = true;
+          }
+        });
         var timeElapsed = Date.now() - startTime;
-        if (timeElapsed >= duration) {
+        if ((timeElapsed >= duration) || failed) {
           clearInterval(intervalId);
           test.next();
         }

dom/media/tests/mochitest/steeplechase_long.ini

@@ -7,5 +7,7 @@ support-files =
   templates.js
   turnConfig.js
 
+[test_peerConnection_basicAudio_long.html]
+[test_peerConnection_basicVideo_long.html]
 [test_peerConnection_basicAudioVideoCombined_long.html]
 

dom/media/tests/mochitest/templates.js

@@ -132,6 +132,9 @@ var commandsPeerConnection = [
           send_message({"offer": test.pcLocal._last_offer,
                         "offer_constraints": test.pcLocal.constraints,
                         "offer_options": test.pcLocal.offerOptions});
+          test._local_offer = test.pcLocal._last_offer;
+          test._offer_constraints = test.pcLocal.constraints;
+          test._offer_options = test.pcLocal.offerOptions;
         }
         test.next();
       });
@@ -199,6 +202,8 @@ var commandsPeerConnection = [
         if (!test.pcLocal) {
           send_message({"answer": test.pcRemote._last_answer,
                         "answer_constraints": test.pcRemote.constraints});
+          test._remote_answer = test.pcRemote._last_answer;
+          test._answer_constraints = test.pcRemote.constraints;
         }
         test.next();
       });

dom/media/tests/mochitest/test_peerConnection_basicAudioVideoCombined_long.html

@@ -20,20 +20,21 @@
 <script type="application/javascript">
   createHTML({
     bug: "1014328",
-    title: "Basic audio/video (combined) peer connection, long running"
+    title: "Basic audio/video (combined) peer connection, long running",
+    visible: true
   });
 
-  FAKE_ENABLED = false;
-
   var test;
   runTest(function (options) {
     options = options || {};
     options.commands = commandsPeerConnection.slice(0);
-    options.commands.push(generateIntervalCommand(verifyConnectionStatus));
+    options.commands.push(generateIntervalCommand(verifyConnectionStatus,
+                                                  1000 * 10,
+                                                  1000 * 3600 * 3));
 
     test = new PeerConnectionTest(options);
-    test.setMediaConstraints([{audio: true, video: true}],
+    test.setMediaConstraints([{audio: true, video: true, fake: false}],
-                             [{audio: true, video: true}]);
+                             [{audio: true, video: true, fake: false}]);
     test.run();
   });
 </script>

dom/media/tests/mochitest/test_peerConnection_basicAudio_long.html

@@ -0,0 +1,43 @@
+<!DOCTYPE HTML>
+
+<!-- This Source Code Form is subject to the terms of the Mozilla Public
+   - License, v. 2.0. If a copy of the MPL was not distributed with this
+   - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
+
+<html>
+<head>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="application/javascript" src="head.js"></script>
+  <script type="application/javascript" src="long.js"></script>
+  <script type="application/javascript" src="mediaStreamPlayback.js"></script>
+  <script type="application/javascript" src="pc.js"></script>
+  <script type="application/javascript" src="templates.js"></script>
+  <script type="application/javascript" src="turnConfig.js"></script>
+</head>
+<body>
+<pre id="test">
+<script type="application/javascript">
+  createHTML({
+    bug: "796892",
+    title: "Basic audio-only peer connection",
+    visible: true
+  });
+
+  var test;
+  runNetworkTest(function (options) {
+    options = options || {};
+    options.commands = commandsPeerConnection.slice(0);
+    options.commands.push(generateIntervalCommand(verifyConnectionStatus,
+                                                  1000 * 10,
+                                                  1000 * 3600 * 3));
+
+    test = new PeerConnectionTest(options);
+    test.setMediaConstraints([{audio: true, fake: false}],
+                             [{audio: true, fake: false}]);
+    test.run();
+  });
+</script>
+</pre>
+</body>
+</html>

dom/media/tests/mochitest/test_peerConnection_basicVideo_long.html

@@ -0,0 +1,43 @@
+<!DOCTYPE HTML>
+
+<!-- This Source Code Form is subject to the terms of the Mozilla Public
+   - License, v. 2.0. If a copy of the MPL was not distributed with this
+   - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
+
+<html>
+<head>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="application/javascript" src="head.js"></script>
+  <script type="application/javascript" src="long.js"></script>
+  <script type="application/javascript" src="mediaStreamPlayback.js"></script>
+  <script type="application/javascript" src="pc.js"></script>
+  <script type="application/javascript" src="templates.js"></script>
+  <script type="application/javascript" src="turnConfig.js"></script>
+</head>
+<body>
+<pre id="test">
+<script type="application/javascript">
+  createHTML({
+    bug: "796888",
+    title: "Basic video-only peer connection",
+    visible: true
+  });
+
+  var test;
+  runNetworkTest(function (options) {
+    options = options || {};
+    options.commands = commandsPeerConnection.slice(0);
+    options.commands.push(generateIntervalCommand(verifyConnectionStatus,
+                                                  1000 * 10,
+                                                  1000 * 3600 * 3));
+
+    test = new PeerConnectionTest(options);
+    test.setMediaConstraints([{video: true, fake: false}],
+                             [{video: true, fake: false}]);
+    test.run();
+  });
+</script>
+</pre>
+</body>
+</html>

dom/plugins/base/nsJSNPRuntime.cpp

@@ -12,6 +12,7 @@
 #include "nsJSNPRuntime.h"
 #include "nsNPAPIPlugin.h"
 #include "nsNPAPIPluginInstance.h"
+#include "nsIGlobalObject.h"
 #include "nsIScriptGlobalObject.h"
 #include "nsIScriptContext.h"
 #include "nsDOMJSUtils.h"
@@ -608,12 +609,17 @@ doInvoke(NPObject *npobj, NPIdentifier method, const NPVariant *args,
          uint32_t argCount, bool ctorCall, NPVariant *result)
 {
   NPP npp = NPPStack::Peek();
-  JSContext *cx = GetJSContext(npp);
 
-  if (!cx) {
+  nsCOMPtr<nsIGlobalObject> globalObject = GetGlobalObject(npp);
+  if (NS_WARN_IF(!globalObject)) {
     return false;
   }
 
+  // We're about to run script via JS_CallFunctionValue, so we need an
+  // AutoEntryScript. NPAPI plugins are Gecko-specific and not in any spec.
+  dom::AutoEntryScript aes(globalObject);
+  JSContext *cx = aes.cx();
+
   if (!npobj || !result) {
     ThrowJSException(cx, "Null npobj, or result in doInvoke!");
 
@@ -625,8 +631,6 @@ doInvoke(NPObject *npobj, NPIdentifier method, const NPVariant *args,
 
   nsJSObjWrapper *npjsobj = (nsJSObjWrapper *)npobj;
 
-  nsCxPusher pusher;
-  pusher.Push(cx);
   JS::Rooted<JSObject*> jsobj(cx, npjsobj->mJSObj);
   JSAutoCompartment ac(cx, jsobj);
   JS::Rooted<JS::Value> fv(cx);
@@ -733,12 +737,17 @@ nsJSObjWrapper::NP_GetProperty(NPObject *npobj, NPIdentifier id,
                                NPVariant *result)
 {
   NPP npp = NPPStack::Peek();
-  JSContext *cx = GetJSContext(npp);
 
-  if (!cx) {
+  nsCOMPtr<nsIGlobalObject> globalObject = GetGlobalObject(npp);
+  if (NS_WARN_IF(!globalObject)) {
     return false;
   }
 
+  // We're about to run script via JS_CallFunctionValue, so we need an
+  // AutoEntryScript. NPAPI plugins are Gecko-specific and not in any spec.
+  dom::AutoEntryScript aes(globalObject);
+  JSContext *cx = aes.cx();
+
   if (!npobj) {
     ThrowJSException(cx,
                      "Null npobj in nsJSObjWrapper::NP_GetProperty!");
@@ -748,8 +757,6 @@ nsJSObjWrapper::NP_GetProperty(NPObject *npobj, NPIdentifier id,
 
   nsJSObjWrapper *npjsobj = (nsJSObjWrapper *)npobj;
 
-  nsCxPusher pusher;
-  pusher.Push(cx);
   AutoJSExceptionReporter reporter(cx);
   JSAutoCompartment ac(cx, npjsobj->mJSObj);
 
@@ -764,12 +771,17 @@ nsJSObjWrapper::NP_SetProperty(NPObject *npobj, NPIdentifier npid,
                                const NPVariant *value)
 {
   NPP npp = NPPStack::Peek();
-  JSContext *cx = GetJSContext(npp);
 
-  if (!cx) {
+  nsCOMPtr<nsIGlobalObject> globalObject = GetGlobalObject(npp);
+  if (NS_WARN_IF(!globalObject)) {
     return false;
   }
 
+  // We're about to run script via JS_CallFunctionValue, so we need an
+  // AutoEntryScript. NPAPI plugins are Gecko-specific and not in any spec.
+  dom::AutoEntryScript aes(globalObject);
+  JSContext *cx = aes.cx();
+
   if (!npobj) {
     ThrowJSException(cx,
                      "Null npobj in nsJSObjWrapper::NP_SetProperty!");
@@ -780,8 +792,6 @@ nsJSObjWrapper::NP_SetProperty(NPObject *npobj, NPIdentifier npid,
   nsJSObjWrapper *npjsobj = (nsJSObjWrapper *)npobj;
   bool ok = false;
 
-  nsCxPusher pusher;
-  pusher.Push(cx);
   AutoJSExceptionReporter reporter(cx);
   JS::Rooted<JSObject*> jsObj(cx, npjsobj->mJSObj);
   JSAutoCompartment ac(cx, jsObj);

gfx/layers/client/TiledContentClient.cpp

@@ -1392,7 +1392,7 @@ ClientTiledLayerBuffer::ComputeProgressiveUpdateRegion(const nsIntRegion& aInval
   // first, and see if we should just abort this paint. Aborting is usually
   // caused by there being an incoming, more relevant paint.
   ViewTransform viewTransform;
-#if defined(MOZ_WIDGET_ANDROID)
+#if defined(MOZ_WIDGET_ANDROID) && !defined(MOZ_ANDROID_APZ)
   FrameMetrics compositorMetrics = scrollAncestor->GetFrameMetrics();
   bool abortPaint = false;
   // On Android, only the primary scrollable layer is async-scrolled, and the only one

gfx/layers/ipc/CompositorParent.cpp

@@ -145,9 +145,10 @@ CompositorThreadHolder::CreateCompositorThread()
      128ms is chosen for transient hangs because 8Hz should be the minimally
      acceptable goal for Compositor responsiveness (normal goal is 60Hz). */
   options.transient_hang_timeout = 128; // milliseconds
-  /* 8192ms is chosen for permanent hangs because it's several seconds longer
+  /* 2048ms is chosen for permanent hangs because it's longer than most
-     than the default hang timeout on major platforms (about 5 seconds). */
+   * Compositor hangs seen in the wild, but is short enough to not miss getting
-  options.permanent_hang_timeout = 8192; // milliseconds
+   * native hang stacks. */
+  options.permanent_hang_timeout = 2048; // milliseconds
 
   if (!compositorThread->StartWithOptions(options)) {
     delete compositorThread;

ipc/contentproc/plugin-container.cpp

@@ -83,6 +83,13 @@ void StartSandboxCallback()
 int
 content_process_main(int argc, char* argv[])
 {
+    // Check for the absolute minimum number of args we need to move
+    // forward here. We expect the last arg to be the child process type.
+    if (argc < 1) {
+      return 3;
+    }
+    XRE_SetProcessType(argv[--argc]);
+
     bool isNuwa = false;
     for (int i = 1; i < argc; i++) {
         isNuwa |= strcmp(argv[i], "-nuwa") == 0;
@@ -114,17 +121,11 @@ content_process_main(int argc, char* argv[])
 #endif
 #endif
 
-    // Check for the absolute minimum number of args we need to move
-    // forward here. We expect the last arg to be the child process type.
-    if (argc < 1)
-      return 3;
-    GeckoProcessType proctype = XRE_StringToChildProcessType(argv[--argc]);
-
 #ifdef XP_WIN
     // For plugins, this is done in PluginProcessChild::Init, as we need to
     // avoid it for unsupported plugins.  See PluginProcessChild::Init for
     // the details.
-    if (proctype != GeckoProcessType_Plugin) {
+    if (XRE_GetProcessType() != GeckoProcessType_Plugin) {
         mozilla::SanitizeEnvironmentVariables();
         SetDllDirectory(L"");
     }
@@ -144,7 +145,7 @@ content_process_main(int argc, char* argv[])
     }
 #endif
 
-    nsresult rv = XRE_InitChildProcess(argc, argv, proctype);
+    nsresult rv = XRE_InitChildProcess(argc, argv);
     NS_ENSURE_SUCCESS(rv, 1);
 
     return 0;

ipc/glue/MessageLink.cpp

@@ -15,6 +15,7 @@
 #include "mozilla/Preferences.h"
 #endif
 
+#include "mozilla/Assertions.h"
 #include "nsDebug.h"
 #include "nsISupportsImpl.h"
 #include "nsXULAppAPI.h"
@@ -58,25 +59,26 @@ MessageLink::MessageLink(MessageChannel *aChan)
 
 MessageLink::~MessageLink()
 {
+#ifdef DEBUG
     mChan = nullptr;
+#endif
 }
 
 ProcessLink::ProcessLink(MessageChannel *aChan)
-  : MessageLink(aChan),
+  : MessageLink(aChan)
-    mExistingListener(nullptr)
+  , mTransport(nullptr)
+  , mIOLoop(nullptr)
+  , mExistingListener(nullptr)
 {
 }
 
 ProcessLink::~ProcessLink()
 {
-    mIOLoop = 0;
+#ifdef DEBUG
-    if (mTransport) {
+    mTransport = nullptr;
-        mTransport->set_listener(0);
+    mIOLoop = nullptr;
-        
+    mExistingListener = nullptr;
-        // we only hold a weak ref to the transport, which is "owned"
+#endif
-        // by GeckoChildProcess/GeckoThread
-        mTransport = 0;
-    }
 }
 
 void 
@@ -291,7 +293,8 @@ ProcessLink::OnEchoMessage(Message* msg)
 void
 ProcessLink::OnChannelOpened()
 {
-    mChan->AssertLinkThread();
+    AssertIOThread();
+
     {
         MonitorAutoLock lock(*mChan->mMonitor);
 
@@ -356,7 +359,11 @@ void
 ProcessLink::OnChannelError()
 {
     AssertIOThread();
+
     MonitorAutoLock lock(*mChan->mMonitor);
+
+    MOZ_ALWAYS_TRUE(this == mTransport->set_listener(mExistingListener));
+
     mChan->OnChannelErrorFromLink();
 }
 
@@ -368,6 +375,9 @@ ProcessLink::OnCloseChannel()
     mTransport->Close();
 
     MonitorAutoLock lock(*mChan->mMonitor);
+
+    MOZ_ALWAYS_TRUE(this == mTransport->set_listener(mExistingListener));
+
     mChan->mChannelState = ChannelClosed;
     mChan->mMonitor->Notify();
 }

ipc/glue/MessageLink.h

@@ -141,6 +141,14 @@ class ProcessLink
   public:
     explicit ProcessLink(MessageChannel *chan);
     virtual ~ProcessLink();
+
+    // The ProcessLink will register itself as the IPC::Channel::Listener on the
+    // transport passed here. If the transport already has a listener registered
+    // then a listener chain will be established (the ProcessLink listener
+    // methods will be called first and may call some methods on the original
+    // listener as well). Once the channel is closed (either via normal shutdown
+    // or a pipe error) the chain will be destroyed and the original listener
+    // will again be registered.
     void Open(Transport* aTransport, MessageLoop *aIOLoop, Side aSide);
     
     // Run on the I/O thread, only when using inter-process link.

ipc/testshell/TestShellParent.cpp

@@ -5,12 +5,14 @@
 #include "TestShellParent.h"
 
 /* This must occur *after* TestShellParent.h to avoid typedefs conflicts. */
+#include "jsfriendapi.h"
 #include "mozilla/ArrayUtils.h"
 
 #include "mozilla/dom/ContentParent.h"
+#include "mozilla/dom/ScriptSettings.h"
 
 #include "nsAutoPtr.h"
-#include "nsCxPusher.h"
+#include "xpcpublic.h"
 
 using namespace mozilla;
 using mozilla::ipc::TestShellParent;
@@ -57,7 +59,6 @@ TestShellCommandParent::SetCallback(JSContext* aCx,
   }
 
   mCallback = aCallback;
-  mCx = aCx;
 
   return true;
 }
@@ -65,22 +66,22 @@ TestShellCommandParent::SetCallback(JSContext* aCx,
 bool
 TestShellCommandParent::RunCallback(const nsString& aResponse)
 {
-  NS_ENSURE_TRUE(!mCallback.get().isNull() && mCx, false);
-
-  // We're pulling a cx off the heap, so make sure it's stack-top.
-  AutoCxPusher pusher(mCx);
   NS_ENSURE_TRUE(mCallback.ToJSObject(), false);
-  JSAutoCompartment ac(mCx, mCallback.ToJSObject());
-  JS::Rooted<JSObject*> global(mCx, JS::CurrentGlobalOrNull(mCx));
 
-  JSString* str = JS_NewUCStringCopyN(mCx, aResponse.get(), aResponse.Length());
+  // We're about to run script via JS_CallFunctionValue, so we need an
+  // AutoEntryScript. This is just for testing and not in any spec.
+  dom::AutoEntryScript aes(xpc::GetNativeForGlobal(js::GetGlobalForObjectCrossCompartment(mCallback.ToJSObject())));
+  JSContext* cx = aes.cx();
+  JS::Rooted<JSObject*> global(cx, JS::CurrentGlobalOrNull(cx));
+
+  JSString* str = JS_NewUCStringCopyN(cx, aResponse.get(), aResponse.Length());
   NS_ENSURE_TRUE(str, false);
 
-  JS::Rooted<JS::Value> strVal(mCx, JS::StringValue(str));
+  JS::Rooted<JS::Value> strVal(cx, JS::StringValue(str));
 
-  JS::Rooted<JS::Value> rval(mCx);
+  JS::Rooted<JS::Value> rval(cx);
-  JS::Rooted<JS::Value> callback(mCx, mCallback);
+  JS::Rooted<JS::Value> callback(cx, mCallback);
-  bool ok = JS_CallFunctionValue(mCx, global, callback, JS::HandleValueArray(strVal), &rval);
+  bool ok = JS_CallFunctionValue(cx, global, callback, JS::HandleValueArray(strVal), &rval);
   NS_ENSURE_TRUE(ok, false);
 
   return true;

ipc/testshell/TestShellParent.h

@@ -40,7 +40,7 @@ public:
 class TestShellCommandParent : public PTestShellCommandParent
 {
 public:
-  TestShellCommandParent() : mCx(nullptr) { }
+  TestShellCommandParent() {}
 
   bool SetCallback(JSContext* aCx, JS::Value aCallback);
 
@@ -58,7 +58,6 @@ protected:
   }
 
 private:
-  JSContext* mCx;
   nsAutoJSValHolder mCallback;
 };
 

js/src/Makefile.in

@@ -314,6 +314,7 @@ selfhosting_srcs := \
   $(srcdir)/builtin/ParallelUtilities.js \
   $(srcdir)/builtin/Array.js \
   $(srcdir)/builtin/Date.js \
+  $(srcdir)/builtin/Error.js \
   $(srcdir)/builtin/Intl.js \
   $(srcdir)/builtin/IntlData.js \
   $(srcdir)/builtin/Iterator.js \

js/src/builtin/Error.js

@@ -0,0 +1,31 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/* ES6 20140718 draft 19.5.3.4. */
+function ErrorToString()
+{
+  /* Steps 1-2. */
+  var obj = this;
+  if (!IsObject(obj))
+    ThrowError(JSMSG_INCOMPATIBLE_PROTO, "Error", "toString", "value");
+
+  /* Steps 3-5. */
+  var name = obj.name;
+  name = (name === undefined) ? "Error" : ToString(name);
+
+  /* Steps 6-8. */
+  var msg = obj.message;
+  msg = (msg === undefined) ? "" : ToString(msg);
+
+  /* Step 9. */
+  if (name === "")
+    return msg;
+
+  /* Step 10. */
+  if (msg === "")
+    return name;
+
+  /* Step 11. */
+  return name + ": " + msg;
+}

js/src/frontend/BytecodeEmitter.cpp

@@ -3242,8 +3242,7 @@ EmitDestructuringOpsHelper(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode
             if (key->isKind(PNK_NUMBER)) {
                 if (!EmitNumberOp(cx, key->pn_dval, bce))
                     return false;
-            } else {
+            } else if (key->isKind(PNK_NAME) || key->isKind(PNK_STRING)) {
-                MOZ_ASSERT(key->isKind(PNK_STRING) || key->isKind(PNK_NAME));
                 PropertyName *name = key->pn_atom->asPropertyName();
 
                 // The parser already checked for atoms representing indexes and
@@ -3258,11 +3257,16 @@ EmitDestructuringOpsHelper(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode
                         return false;
                     doElemOp = false;
                 }
+            } else {
+                JS_ASSERT(key->isKind(PNK_COMPUTED_NAME));
+                if (!EmitTree(cx, bce, key->pn_kid))
+                    return false;
             }
 
             pn3 = pn2->pn_right;
         }
 
+
         if (doElemOp) {
             /*
              * Ok, get the value of the matching property name.  This leaves
@@ -5549,12 +5553,38 @@ EmitStatement(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
             if (Emit1(cx, bce, op) < 0)
                 return false;
         }
-    } else if (!pn->isDirectivePrologueMember()) {
+    } else if (pn->isDirectivePrologueMember()) {
-        /* Don't complain about directive prologue members; just don't emit their code. */
+        // Don't complain about directive prologue members; just don't emit
-        bce->current->currentLine = bce->parser->tokenStream.srcCoords.lineNum(pn2->pn_pos.begin);
+        // their code.
-        bce->current->lastColumn = 0;
+    } else {
-        if (!bce->reportStrictWarning(pn2, JSMSG_USELESS_EXPR))
+        if (JSAtom *atom = pn->isStringExprStatement()) {
-            return false;
+            // Warn if encountering a non-directive prologue member string
+            // expression statement, that is inconsistent with the current
+            // directive prologue.  That is, a script *not* starting with
+            // "use strict" should warn for any "use strict" statements seen
+            // later in the script, because such statements are misleading.
+            const char *directive = nullptr;
+            if (atom == cx->names().useStrict) {
+                if (!bce->sc->strict)
+                    directive = js_useStrict_str;
+            } else if (atom == cx->names().useAsm) {
+                if (bce->sc->isFunctionBox()) {
+                    JSFunction *fun = bce->sc->asFunctionBox()->function();
+                    if (fun->isNative() && IsAsmJSModuleNative(fun->native()))
+                        directive = js_useAsm_str;
+                }
+            }
+
+            if (directive) {
+                if (!bce->reportStrictWarning(pn2, JSMSG_CONTRARY_NONDIRECTIVE, directive))
+                    return false;
+            }
+        } else {
+            bce->current->currentLine = bce->parser->tokenStream.srcCoords.lineNum(pn2->pn_pos.begin);
+            bce->current->lastColumn = 0;
+            if (!bce->reportStrictWarning(pn2, JSMSG_USELESS_EXPR))
+                return false;
+        }
     }
 
     return true;
@@ -6053,17 +6083,21 @@ EmitObject(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
             if (!EmitNumberOp(cx, pn3->pn_dval, bce))
                 return false;
             isIndex = true;
-        } else {
+        } else if (pn3->isKind(PNK_NAME) || pn3->isKind(PNK_STRING)) {
             // The parser already checked for atoms representing indexes and
             // used PNK_NUMBER instead, but also watch for ids which TI treats
             // as indexes for simpliciation of downstream analysis.
-            JS_ASSERT(pn3->isKind(PNK_NAME) || pn3->isKind(PNK_STRING));
             jsid id = NameToId(pn3->pn_atom->asPropertyName());
             if (id != types::IdToTypeId(id)) {
                 if (!EmitTree(cx, bce, pn3))
                     return false;
                 isIndex = true;
             }
+        } else {
+            JS_ASSERT(pn3->isKind(PNK_COMPUTED_NAME));
+            if (!EmitTree(cx, bce, pn3->pn_kid))
+                return false;
+            isIndex = true;
         }
 
         /* Emit code for the property initializer. */

js/src/frontend/FullParseHandler.h

@@ -90,6 +90,11 @@ class FullParseHandler
         return new_<NameNode>(PNK_NAME, JSOP_NAME, name, blockid, pos);
     }
 
+    ParseNode *newComputedName(ParseNode *expr, uint32_t begin, uint32_t end) {
+        TokenPos pos(begin, end);
+        return new_<UnaryNode>(PNK_COMPUTED_NAME, JSOP_NOP, pos, expr);
+    }
+
     Definition *newPlaceholder(JSAtom *atom, uint32_t blockid, const TokenPos &pos) {
         Definition *dn =
             (Definition *) new_<NameNode>(PNK_NAME, JSOP_NOP, atom, blockid, pos);

js/src/frontend/ParseNode.h

@@ -89,6 +89,7 @@ class UpvarCookie
     F(OBJECT) \
     F(CALL) \
     F(NAME) \
+    F(COMPUTED_NAME) \
     F(NUMBER) \
     F(STRING) \
     F(TEMPLATE_STRING_LIST) \
@@ -393,6 +394,8 @@ enum ParseNodeKind
  *                          pn_left: property id, pn_right: value
  * PNK_SHORTHAND binary     Same fields as PNK_COLON. This is used for object
  *                          literal properties using shorthand ({x}).
+ * PNK_COMPUTED_NAME unary  ES6 ComputedPropertyName.
+ *                          pn_kid: the AssignmentExpression inside the square brackets
  * PNK_NAME,    name        pn_atom: name, string, or object atom
  * PNK_STRING               pn_op: JSOP_NAME, JSOP_STRING, or JSOP_OBJECT
  *                          If JSOP_NAME, pn_op may be JSOP_*ARG or JSOP_*VAR

js/src/frontend/Parser.cpp

@@ -7259,6 +7259,20 @@ Parser<ParseHandler>::objectLiteral()
             propname = newNumber(tokenStream.currentToken());
             break;
 
+          case TOK_LB: {
+              // Computed property name.
+              uint32_t begin = pos().begin;
+              Node assignNode = assignExpr();
+              if (!assignNode)
+                  return null();
+              MUST_MATCH_TOKEN(TOK_RB, JSMSG_COMP_PROP_UNTERM_EXPR);
+              propname = handler.newComputedName(assignNode, begin, pos().end);
+              if (!propname)
+                  return null();
+              handler.setListFlag(literal, PNX_NONCONST);
+              break;
+          }
+
           case TOK_NAME: {
             atom = tokenStream.currentName();
             if (atom == context->names().get) {

js/src/frontend/SyntaxParseHandler.h

@@ -61,6 +61,10 @@ class SyntaxParseHandler
         return NodeName;
     }
 
+    Node newComputedName(Node expr, uint32_t start, uint32_t end) {
+        return NodeName;
+    }
+
     DefinitionNode newPlaceholder(JSAtom *atom, uint32_t blockid, const TokenPos &pos) {
         return Definition::PLACEHOLDER;
     }

js/src/jit-test/tests/basic/error-toString.js

@@ -1,7 +1,7 @@
 var errorToString = Error.prototype.toString;
 
 
-assertEq(errorToString.call({message: "", name: ""}), "Error");
+assertEq(errorToString.call({message: "", name: ""}), "");
 assertEq(errorToString.call({name: undefined, message: ""}), "Error");
 assertEq(errorToString.call({name: "Test", message: undefined}), "Test");
 assertEq(errorToString.call({name: "Test", message: ""}), "Test");

js/src/jit-test/tests/class/compProp.js

@@ -0,0 +1,15 @@
+load(libdir + "asserts.js");
+
+function f(tag) { return {[tag]: 1}; }
+a = [];
+for (var i = 0; i < 2000; i++)
+    a[i] = f("first");
+
+for (var i = 0; i < 2000; i++)
+    assertEq(a[i].first, 1);
+
+for (var i = 0; i < 2000; i++)
+    a[i] = f("second");
+
+for (var i = 0; i < 2000; i++)
+    assertEq(a[i].second, 1);

js/src/jit/x86/Assembler-x86.cpp

@@ -30,7 +30,7 @@ ABIArgGenerator::next(MIRType type)
         stackOffset_ += sizeof(uint64_t);
         break;
       default:
-        MOZ_ASSUME_UNREACHABLE("Unexpected argument type");
+        MOZ_CRASH("Unexpected argument type");
     }
     return current_;
 }

js/src/jit/x86/Assembler-x86.h

@@ -248,7 +248,7 @@ class Assembler : public AssemblerX86Shared
             writeDataRelocation(ptr);
             break;
           default:
-            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
+            MOZ_CRASH("unexpected operand kind");
         }
     }
     void movl(ImmWord imm, Register dest) {
@@ -305,7 +305,7 @@ class Assembler : public AssemblerX86Shared
             masm.fld32_m(dest.disp(), dest.base());
             break;
           default:
-            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
+            MOZ_CRASH("unexpected operand kind");
         }
     }
 
@@ -315,7 +315,7 @@ class Assembler : public AssemblerX86Shared
             masm.fstp32_m(src.disp(), src.base());
             break;
           default:
-            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
+            MOZ_CRASH("unexpected operand kind");
         }
     }
 
@@ -347,7 +347,7 @@ class Assembler : public AssemblerX86Shared
             writeDataRelocation(imm);
             break;
           default:
-            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
+            MOZ_CRASH("unexpected operand kind");
         }
     }
     void cmpl(AsmJSAbsoluteAddress lhs, Register rhs) {

js/src/jit/x86/Bailouts-x86.cpp

@@ -80,7 +80,7 @@ IonBailoutIterator::IonBailoutIterator(const JitActivationIterator &activations,
     switch (mode_) {
       case SequentialExecution: topIonScript_ = script()->ionScript(); break;
       case ParallelExecution: topIonScript_ = script()->parallelIonScript(); break;
-      default: MOZ_ASSUME_UNREACHABLE("No such execution mode");
+      default: MOZ_CRASH("No such execution mode");
     }
 
     if (bailout->frameClass() == FrameSizeClass::None()) {

js/src/jit/x86/BaselineIC-x86.cpp

@@ -191,7 +191,7 @@ ICBinaryArith_Int32::Compiler::generateStubCode(MacroAssembler &masm)
         }
         break;
       default:
-       MOZ_ASSUME_UNREACHABLE("Unhandled op for BinaryArith_Int32.  ");
+       MOZ_CRASH("Unhandled op for BinaryArith_Int32.");
     }
 
     // Return.
@@ -252,7 +252,7 @@ ICUnaryArith_Int32::Compiler::generateStubCode(MacroAssembler &masm)
         masm.negl(R0.payloadReg());
         break;
       default:
-        MOZ_ASSUME_UNREACHABLE("Unexpected op");
+        MOZ_CRASH("Unexpected op");
     }
 
     EmitReturnFromIC(masm);

js/src/jit/x86/CodeGenerator-x86.cpp

@@ -280,7 +280,7 @@ CodeGeneratorX86::loadViewTypeElement(Scalar::Type vt, const T &srcAddr,
       case Scalar::Uint32:  masm.movlWithPatch(srcAddr, ToRegister(out)); break;
       case Scalar::Float32: masm.movssWithPatch(srcAddr, ToFloatRegister(out)); break;
       case Scalar::Float64: masm.movsdWithPatch(srcAddr, ToFloatRegister(out)); break;
-      default: MOZ_ASSUME_UNREACHABLE("unexpected array type");
+      default: MOZ_CRASH("unexpected array type");
     }
 }
 
@@ -385,7 +385,7 @@ CodeGeneratorX86::storeViewTypeElement(Scalar::Type vt, const LAllocation *value
       case Scalar::Uint32:  masm.movlWithPatch(ToRegister(value), dstAddr); break;
       case Scalar::Float32: masm.movssWithPatch(ToFloatRegister(value), dstAddr); break;
       case Scalar::Float64: masm.movsdWithPatch(ToFloatRegister(value), dstAddr); break;
-      default: MOZ_ASSUME_UNREACHABLE("unexpected array type");
+      default: MOZ_CRASH("unexpected array type");
     }
 }
 
@@ -544,7 +544,7 @@ DispatchIonCache::initializeAddCacheState(LInstruction *ins, AddCacheState *addS
 {
     // On x86, where there is no general purpose scratch register available,
     // child cache classes must manually specify a dispatch scratch register.
-    MOZ_ASSUME_UNREACHABLE("x86 needs manual assignment of dispatchScratch");
+    MOZ_CRASH("x86 needs manual assignment of dispatchScratch");
 }
 
 void

js/src/jit/x86/Lowering-x86.cpp

@@ -254,7 +254,7 @@ LIRGeneratorX86::visitAsmJSStoreHeap(MAsmJSStoreHeap *ins)
             // See comment below.
             lir = new(alloc()) LAsmJSStoreHeap(ptrAlloc, useRegisterAtStart(ins->value()));
             break;
-          default: MOZ_ASSUME_UNREACHABLE("unexpected array type");
+          default: MOZ_CRASH("unexpected array type");
         }
         return add(lir, ins);
     }
@@ -271,7 +271,7 @@ LIRGeneratorX86::visitAsmJSStoreHeap(MAsmJSStoreHeap *ins)
         // affects instruction layout which affects patching.
         lir = new(alloc()) LAsmJSStoreHeap(useRegisterAtStart(ptr), useRegisterAtStart(ins->value()));
         break;
-      default: MOZ_ASSUME_UNREACHABLE("unexpected array type");
+      default: MOZ_CRASH("unexpected array type");
     }
 
     return add(lir, ins);
@@ -295,7 +295,7 @@ LIRGeneratorX86::visitStoreTypedArrayElementStatic(MStoreTypedArrayElementStatic
         lir = new(alloc()) LStoreTypedArrayElementStatic(useRegisterAtStart(ins->ptr()),
                                                          useRegisterAtStart(ins->value()));
         break;
-      default: MOZ_ASSUME_UNREACHABLE("unexpected array type");
+      default: MOZ_CRASH("unexpected array type");
     }
 
     return add(lir, ins);

js/src/jit/x86/MacroAssembler-x86.cpp

@@ -173,7 +173,7 @@ MacroAssemblerX86::passABIArg(const MoveOperand &from, MoveOp::Type type)
       case MoveOp::DOUBLE:  stackForCall_ += sizeof(double); break;
       case MoveOp::INT32:   stackForCall_ += sizeof(int32_t); break;
       case MoveOp::GENERAL: stackForCall_ += sizeof(intptr_t); break;
-      default: MOZ_ASSUME_UNREACHABLE("Unexpected argument type");
+      default: MOZ_CRASH("Unexpected argument type");
     }
     enoughMemory_ &= moveResolver_.addMove(from, to, type);
 }

js/src/jit/x86/MacroAssembler-x86.h

@@ -102,7 +102,7 @@ class MacroAssemblerX86 : public MacroAssemblerX86Shared
                            base.scale(), base.disp() + sizeof(void *));
 
           default:
-            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
+            MOZ_CRASH("unexpected operand kind");
         }
     }
     Address ToType(Address base) {

js/src/jit/x86/Trampoline-x86.cpp

@@ -575,7 +575,7 @@ JitRuntime::generateBailoutHandler(JSContext *cx, ExecutionMode mode)
         GenerateParallelBailoutThunk(masm, NO_FRAME_SIZE_CLASS_ID);
         break;
       default:
-        MOZ_ASSUME_UNREACHABLE("No such execution mode");
+        MOZ_CRASH("No such execution mode");
     }
 
     Linker linker(masm);
@@ -711,7 +711,7 @@ JitRuntime::generateVMWrapper(JSContext *cx, const VMFunction &f)
         masm.j(Assembler::Zero, masm.failureLabel(f.executionMode));
         break;
       default:
-        MOZ_ASSUME_UNREACHABLE("unknown failure kind");
+        MOZ_CRASH("unknown failure kind");
     }
 
     // Load the outparam and free any allocated stack.

js/src/js.msg

@@ -274,7 +274,7 @@ MSG_DEF(JSMSG_BAD_DELETE_OPERAND,     220, 0, JSEXN_REFERENCEERR, "invalid delet
 MSG_DEF(JSMSG_BAD_INCOP_OPERAND,      221, 0, JSEXN_REFERENCEERR, "invalid increment/decrement operand")
 MSG_DEF(JSMSG_UNEXPECTED_TYPE,        222, 2, JSEXN_TYPEERR, "{0} is {1}")
 MSG_DEF(JSMSG_LET_DECL_NOT_IN_BLOCK,  223, 0, JSEXN_SYNTAXERR, "let declaration not directly within block")
-MSG_DEF(JSMSG_UNUSED224,              224, 0, JSEXN_NONE, "")
+MSG_DEF(JSMSG_CONTRARY_NONDIRECTIVE,  224, 1, JSEXN_SYNTAXERR, "'{0}' statement won't be enforced as a directive because it isn't in directive prologue position")
 MSG_DEF(JSMSG_CANT_SET_ARRAY_ATTRS,   225, 0, JSEXN_INTERNALERR, "can't set attributes on indexed array properties")
 MSG_DEF(JSMSG_EVAL_ARITY,             226, 0, JSEXN_TYPEERR, "eval accepts only one parameter")
 MSG_DEF(JSMSG_MISSING_FUN_ARG,        227, 2, JSEXN_TYPEERR, "missing argument {0} when calling function {1}")
@@ -443,3 +443,4 @@ MSG_DEF(JSMSG_PROXY_GETOWN_OBJORUNDEF,  388, 0, JSEXN_TYPEERR, "proxy [[GetOwnPr
 MSG_DEF(JSMSG_CANT_REPORT_C_AS_NC,      389, 0, JSEXN_TYPEERR, "proxy can't report existing configurable property as non-configurable")
 MSG_DEF(JSMSG_PROXY_REVOKED,            390, 0, JSEXN_TYPEERR, "illegal operation attempted on a revoked proxy")
 MSG_DEF(JSMSG_TEMPLSTR_UNTERM_EXPR,     391, 0, JSEXN_SYNTAXERR, "missing } in template string")
+MSG_DEF(JSMSG_COMP_PROP_UNTERM_EXPR,    392, 0, JSEXN_SYNTAXERR, "missing ] in computed property name")

js/src/jsapi-tests/testChromeBuffer.cpp

@@ -112,7 +112,12 @@ BEGIN_TEST(testChromeBuffer)
             const char *bytes = "try {                                  "
                                 "  untrusted();                         "
                                 "} catch (e) {                          "
-                                "  return 'From trusted: ' + e;         "
+                                "  /*                                   "
+                                "   * Careful!  We must not reenter JS  "
+                                "   * that might try to push a frame.   "
+                                "   */                                  "
+                                "  return 'From trusted: ' +            "
+                                "         e.name + ': ' + e.message;    "
                                 "}                                      ";
             JS::HandleObject global = JS::HandleObject::fromMarkedLocation(trusted_glob.unsafeGet());
             JS::CompileOptions options(cx);

js/src/jsast.tbl

@@ -73,5 +73,6 @@ ASTDEF(AST_PROP_PATT,             "Property",                       "propertyPat
 ASTDEF(AST_TEMPLATE_LITERAL,      "TemplateLiteral",                "templateLiteral")
 ASTDEF(AST_TAGGED_TEMPLATE,       "TaggedTemplate",                 "taggedTemplate")
 ASTDEF(AST_CALL_SITE_OBJ,         "CallSiteObject",                 "callSiteObject")
+ASTDEF(AST_COMPUTED_NAME,         "ComputedName",                   "computedName")
 
 /* AST_LIMIT = last + 1 */

js/src/jsexn.cpp

@@ -51,14 +51,11 @@ Error(JSContext *cx, unsigned argc, Value *vp);
 static bool
 exn_toSource(JSContext *cx, unsigned argc, Value *vp);
 
-static bool
-exn_toString(JSContext *cx, unsigned argc, Value *vp);
-
 static const JSFunctionSpec exception_methods[] = {
 #if JS_HAS_TOSOURCE
     JS_FN(js_toSource_str, exn_toSource, 0, 0),
 #endif
-    JS_FN(js_toString_str, exn_toString, 0, 0),
+    JS_SELF_HOSTED_FN(js_toString_str, "ErrorToString", 0,0),
     JS_FS_END
 };
 
@@ -375,82 +372,6 @@ Error(JSContext *cx, unsigned argc, Value *vp)
     return true;
 }
 
-/* ES5 15.11.4.4 (NB: with subsequent errata). */
-static bool
-exn_toString(JSContext *cx, unsigned argc, Value *vp)
-{
-    JS_CHECK_RECURSION(cx, return false);
-    CallArgs args = CallArgsFromVp(argc, vp);
-
-    /* Step 2. */
-    if (!args.thisv().isObject()) {
-        JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_BAD_PROTOTYPE, "Error");
-        return false;
-    }
-
-    /* Step 1. */
-    RootedObject obj(cx, &args.thisv().toObject());
-
-    /* Step 3. */
-    RootedValue nameVal(cx);
-    if (!JSObject::getProperty(cx, obj, obj, cx->names().name, &nameVal))
-        return false;
-
-    /* Step 4. */
-    RootedString name(cx);
-    if (nameVal.isUndefined()) {
-        name = cx->names().Error;
-    } else {
-        name = ToString<CanGC>(cx, nameVal);
-        if (!name)
-            return false;
-    }
-
-    /* Step 5. */
-    RootedValue msgVal(cx);
-    if (!JSObject::getProperty(cx, obj, obj, cx->names().message, &msgVal))
-        return false;
-
-    /* Step 6. */
-    RootedString message(cx);
-    if (msgVal.isUndefined()) {
-        message = cx->runtime()->emptyString;
-    } else {
-        message = ToString<CanGC>(cx, msgVal);
-        if (!message)
-            return false;
-    }
-
-    /* Step 7. */
-    if (name->empty() && message->empty()) {
-        args.rval().setString(cx->names().Error);
-        return true;
-    }
-
-    /* Step 8. */
-    if (name->empty()) {
-        args.rval().setString(message);
-        return true;
-    }
-
-    /* Step 9. */
-    if (message->empty()) {
-        args.rval().setString(name);
-        return true;
-    }
-
-    /* Step 10. */
-    StringBuffer sb(cx);
-    if (!sb.append(name) || !sb.append(": ") || !sb.append(message))
-        return false;
-
-    JSString *str = sb.finishString();
-    if (!str)
-        return false;
-    args.rval().setString(str);
-    return true;
-}
-
 #if JS_HAS_TOSOURCE
 /*
  * Return a string that may eval to something similar to the original object.

js/src/jsreflect.cpp

@@ -440,6 +440,25 @@ class NodeBuilder
                setResult(node, dst);
     }
 
+    bool newNode(ASTType type, TokenPos *pos,
+                 const char *childName1, HandleValue child1,
+                 const char *childName2, HandleValue child2,
+                 const char *childName3, HandleValue child3,
+                 const char *childName4, HandleValue child4,
+                 const char *childName5, HandleValue child5,
+                 const char *childName6, HandleValue child6,
+                 MutableHandleValue dst) {
+        RootedObject node(cx);
+        return newNode(type, pos, &node) &&
+               setProperty(node, childName1, child1) &&
+               setProperty(node, childName2, child2) &&
+               setProperty(node, childName3, child3) &&
+               setProperty(node, childName4, child4) &&
+               setProperty(node, childName5, child5) &&
+               setProperty(node, childName6, child6) &&
+               setResult(node, dst);
+    }
+
     bool newNode(ASTType type, TokenPos *pos,
                  const char *childName1, HandleValue child1,
                  const char *childName2, HandleValue child2,
@@ -638,6 +657,8 @@ class NodeBuilder
 
     bool spreadExpression(HandleValue expr, TokenPos *pos, MutableHandleValue dst);
 
+    bool computedName(HandleValue name, TokenPos *pos, MutableHandleValue dst);
+
     bool objectExpression(NodeVector &elts, TokenPos *pos, MutableHandleValue dst);
 
     bool thisExpression(TokenPos *pos, MutableHandleValue dst);
@@ -1253,6 +1274,14 @@ NodeBuilder::templateLiteral(NodeVector &elts, TokenPos *pos, MutableHandleValue
     return listNode(AST_TEMPLATE_LITERAL, "elements", elts, pos, dst);
 }
 
+bool
+NodeBuilder::computedName(HandleValue name, TokenPos *pos, MutableHandleValue dst)
+{
+    return newNode(AST_COMPUTED_NAME, pos,
+                   "name", name,
+                   dst);
+}
+
 bool
 NodeBuilder::spreadExpression(HandleValue expr, TokenPos *pos, MutableHandleValue dst)
 {
@@ -2873,6 +2902,13 @@ ASTSerializer::expression(ParseNode *pn, MutableHandleValue dst)
                  builder.spreadExpression(expr, &pn->pn_pos, dst);
       }
 
+      case PNK_COMPUTED_NAME:
+      {
+         RootedValue name(cx);
+         return expression(pn->pn_kid, &name) &&
+                builder.computedName(name, &pn->pn_pos, dst);
+      }
+
       case PNK_OBJECT:
       {
         NodeVector elts(cx);
@@ -2962,6 +2998,8 @@ ASTSerializer::expression(ParseNode *pn, MutableHandleValue dst)
 bool
 ASTSerializer::propertyName(ParseNode *pn, MutableHandleValue dst)
 {
+    if (pn->isKind(PNK_COMPUTED_NAME))
+        return expression(pn, dst);
     if (pn->isKind(PNK_NAME))
         return identifier(pn, dst);
 

js/src/jsstr.cpp

@@ -4,17 +4,6 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-/*
- * JS string type implementation.
- *
- * In order to avoid unnecessary js_LockGCThing/js_UnlockGCThing calls, these
- * native methods store strings (possibly newborn) converted from their 'this'
- * parameter and arguments on the stack: 'this' conversions at argv[-1], arg
- * conversions at their index (argv[0], argv[1]).  This is a legitimate method
- * of rooting things that might lose their newborn root due to subsequent GC
- * allocations in the same native method.
- */
-
 #include "jsstr.h"
 
 #include "mozilla/Attributes.h"

js/src/tests/ecma_5/extensions/error-tostring-function.js

@@ -0,0 +1,45 @@
+// Any copyright is dedicated to the Public Domain.
+// http://creativecommons.org/licenses/publicdomain/
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 894653;
+var summary =
+  "Error.prototype.toString called on function objects should work as on any " +
+  "object";
+
+print(BUGNUMBER + ": " + summary);
+
+/**************
+ * BEGIN TEST *
+ **************/
+
+function ErrorToString(v)
+{
+  return Error.prototype.toString.call(v);
+}
+
+// The name property of function objects isn't standardized, so this must be an
+// extension-land test.
+
+assertEq(ErrorToString(function f(){}), "f");
+assertEq(ErrorToString(function g(){}), "g");
+assertEq(ErrorToString(function(){}), "");
+
+var fn1 = function() {};
+fn1.message = "ohai";
+assertEq(ErrorToString(fn1), "ohai");
+
+var fn2 = function blerch() {};
+fn2.message = "fnord";
+assertEq(ErrorToString(fn2), "blerch: fnord");
+
+var fn3 = function() {};
+fn3.message = "";
+assertEq(ErrorToString(fn3), "");
+
+/******************************************************************************/
+
+if (typeof reportCompare === "function")
+  reportCompare(true, true);
+
+print("Tests complete!");

js/src/tests/ecma_5/extensions/misplaced-inconsistent-directive.js

@@ -0,0 +1,65 @@
+// |reftest| skip-if(!xulRuntime.shell) -- needs evaluate()
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ * Contributor:
+ *   Jeff Walden <jwalden+code@mit.edu>
+ */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 1046964;
+var summary =
+  "Misplaced directives (e.g. 'use strict') should trigger warnings if they " +
+  "contradict the actually-used semantics";
+
+print(BUGNUMBER + ": " + summary);
+
+/**************
+ * BEGIN TEST *
+ **************/
+
+options("strict");
+options("werror");
+
+function evaluateNoRval(code)
+{
+  evaluate(code, { compileAndGo: true, noScriptRval: true });
+}
+
+function expectSyntaxError(code)
+{
+  try
+  {
+    evaluateNoRval(code);
+    throw new Error("didn't throw");
+  }
+  catch (e)
+  {
+    assertEq(e instanceof SyntaxError, true,
+             "should have thrown a SyntaxError, instead got:\n" +
+             "    " + e + "\n" +
+             "when evaluating:\n" +
+             "    " + code);
+  }
+}
+
+expectSyntaxError("function f1() {} 'use strict'; function f2() {}");
+expectSyntaxError("function f3() { var x; 'use strict'; }");
+
+expectSyntaxError("function f4() {} 'use asm'; function f5() {}");
+expectSyntaxError("function f6() { var x; 'use strict'; }");
+expectSyntaxError("'use asm'; function f7() {}");
+
+// No errors expected -- useless non-directives, but not contrary to used
+// semantics.
+evaluateNoRval("'use strict'; function f8() {} 'use strict'; function f9() {}");
+evaluateNoRval("'use strict'; function f10() { var z; 'use strict' }");
+
+evaluateNoRval("function f11() { 'use asm'; return {}; }");
+
+/******************************************************************************/
+
+if (typeof reportCompare === "function")
+  reportCompare(true, true);
+
+print("Tests complete");

js/src/tests/ecma_6/Class/compPropDestr.js

@@ -0,0 +1,11 @@
+var BUGNUMBER = 924688;
+var summary = 'Computed Property Names';
+
+print(BUGNUMBER + ": " + summary);
+
+var key = "z";
+var { [key]: foo } = { z: "bar" };
+assertEq(foo, "bar");
+
+
+reportCompare(0, 0, "ok");

js/src/tests/ecma_6/Class/compPropNames.js

@@ -0,0 +1,181 @@
+var BUGNUMBER = 924688;
+var summary = 'Computed Property Names';
+
+print(BUGNUMBER + ": " + summary);
+
+// Function definitions.
+function syntaxError (script) {
+    try {
+        Function(script);
+    } catch (e) {
+        if (e instanceof SyntaxError) {
+            return;
+        }
+    }
+    throw new Error('Expected syntax error: ' + script);
+}
+
+
+// Tests begin.
+
+assertThrowsInstanceOf(function() { var a = {[field1]: "a", [field2]: "b"}; }, ReferenceError);
+
+assertThrowsInstanceOf(function() {
+                           field1 = 1;
+                           var a = {[field1]: "a", [field2]: "b"};
+                       }, ReferenceError);
+
+var f1 = 1;
+var f2 = 2;
+var a = {[f1]: "a", [f2]: "b"};
+assertEq(a[1], "a");
+assertEq(a[2], "b");
+
+var a = {[f1]: "a", f2: "b"};
+assertEq(a[1], "a");
+assertEq(a.f2, "b");
+
+var a = {["f1"]: "a", [++f2]: "b"};
+assertEq(a.f1, "a");
+assertEq(a[3], "b");
+
+var a = {["f1"]: "a", f2: "b"};
+assertEq(a.f1, "a");
+assertEq(a.f2, "b");
+
+
+var i = 0;
+var a = {
+    ["foo" + ++i]: i,
+    ["foo" + ++i]: i,
+    ["foo" + ++i]: i
+};
+assertEq(a.foo1, 1);
+assertEq(a.foo2, 2);
+assertEq(a.foo3, 3);
+
+syntaxError("({[");
+syntaxError("({[expr");
+syntaxError("({[expr]");
+syntaxError("({[expr]})");
+syntaxError("({[expr] 0})");
+syntaxError("({[expr], 0})");
+syntaxError("[[expr]: 0]");
+syntaxError("({[expr]: name: 0})");
+syntaxError("({[1, 2]: 3})");  // because '1,2' is an Expression but not an AssignmentExpression
+syntaxError("({[1;]: 1})");    // and not an ExpressionStatement
+syntaxError("({[if (0) 0;]})");  // much less a Statement
+syntaxError("function f() { {[x]: 1} }");  // that's not even an ObjectLiteral
+syntaxError("function f() { [x]: 1 }");    // or that
+syntaxError('a = {[f1@]: "a", [f2]: "b"}'); // unexpected symbol at end of AssignmentExpression
+try { JSON.parse('{["a"]:4}'); } catch(e) {
+    if (!(e instanceof SyntaxError)) throw new Error('Expected syntax error');
+}
+
+// Property characteristics.
+a = { ["b"] : 4 };
+b = Object.getOwnPropertyDescriptor(a, "b");
+assertEq(b.configurable, true);
+assertEq(b.enumerable, true);
+assertEq(b.writable, true);
+assertEq(b.value, 4);
+
+// Setter and getter are not hit.
+Object.defineProperty(Object.prototype, "x", { set: function (x) { throw "FAIL"; },
+                                               get: function (x) { throw "FAIL"; } });
+var a = {["x"]: 0};
+assertEq(a.x, 0);
+
+a = {["x"]: 1, ["x"]: 2};
+assertEq(a.x, 2);
+a = {x: 1, ["x"]: 2};
+assertEq(a.x, 2);
+a = {["x"]: 1, x: 2};
+assertEq(a.x, 2);
+
+// Symbols
+var unique_sym = Symbol("1"), registered_sym = Symbol.for("2");
+a = { [unique_sym] : 2, [registered_sym] : 3 };
+assertEq(a[unique_sym], 2);
+assertEq(a[registered_sym], 3);
+
+// Same expression can be run several times to build objects with different property names.
+a = [];
+for (var i = 0; i < 3; i++) {
+    a[i] = {["foo" + i]: i};
+}
+assertEq(a[0].foo0, 0);
+assertEq(a[1].foo1, 1);
+assertEq(a[2].foo2, 2);
+
+// Following are stored in object's elements rather than slots.
+var i = 0;
+a = { [++i] : i,
+      [++i] : i,
+      [++i] : i,
+      [++i] : i,
+      [++i] : i,
+      [++i] : i,
+      [++i] : i,
+      [++i] : i
+}
+for (var i = 1; i < 9; i++)
+    assertEq(a[i], i);
+syntaxError("a.1");
+syntaxError("a.2");
+syntaxError("a.3");
+syntaxError("a.4");
+syntaxError("a.5");
+syntaxError("a.6");
+syntaxError("a.7");
+syntaxError("a.8");
+
+// Adding a single large index.
+var i = 0;
+a = { [++i] : i,
+      [++i] : i,
+      [++i] : i,
+      [++i] : i,
+      [++i] : i,
+      [++i] : i,
+      [++i] : i,
+      [++i] : i,
+      [3000] : 2999
+}
+for (var i = 1; i < 9; i++)
+    assertEq(a[i], i);
+assertEq(a[3000], 2999);
+
+// Defining several properties using eval.
+var code = "({";
+for (i = 0; i < 1000; i++)
+    code += "['foo' + " + i + "]: 'ok', "
+code += "['bar']: 'ok'});";
+var obj = eval(code);
+for (i = 0; i < 1000; i++)
+    assertEq(obj["foo" + i], "ok");
+assertEq(obj["bar"], "ok");
+
+// Can yield in a computed property name which is in a generator.
+function* g() {
+    var a = { [yield 1]: 2, [yield 2]: 3};
+    return a;
+}
+
+var it = g();
+var next = it.next();
+assertEq(next.done, false);
+assertEq(next.value, 1);
+next = it.next("hello");
+assertEq(next.done, false);
+assertEq(next.value, 2);
+next = it.next("world");
+assertEq(next.done, true);
+assertEq(next.value.hello, 2);
+assertEq(next.value.world, 3);
+
+syntaxError("a = {get [expr]() { return 3; }, set[expr](v) { return 2; }}");
+
+
+
+reportCompare(0, 0, "ok");

js/src/tests/js1_8_5/extensions/reflect-parse.js

@@ -92,6 +92,7 @@ function newExpr(callee, args) Pattern({ type: "NewExpression", callee: callee,
 function callExpr(callee, args) Pattern({ type: "CallExpression", callee: callee, arguments: args })
 function arrExpr(elts) Pattern({ type: "ArrayExpression", elements: elts })
 function objExpr(elts) Pattern({ type: "ObjectExpression", properties: elts })
+function computedName(elts) Pattern({ type: "ComputedName", name: elts })
 function templateLit(elts) Pattern({ type: "TemplateLiteral", elements: elts })
 function taggedTemplate(tagPart, templatePart) Pattern({ type: "TaggedTemplate", callee: tagPart,
                 arguments : templatePart })
@@ -379,6 +380,29 @@ program([exprStmt(ident("f")),
                 funDecl(ident("f"), [], blockStmt([])),
                 null)]).assert(Reflect.parse("f; if (1) function f(){}"));
 
+// Bug 924688: computed property names
+assertExpr('a= {[field1]: "a", [field2=1]: "b"}',
+          aExpr("=", ident("a"),
+                objExpr([{ key: computedName(ident("field1")), value: lit("a")},
+                         { key: computedName(aExpr("=", ident("field2"), lit(1))),
+                           value: lit("b")}])));
+
+assertExpr('a= {["field1"]: "a", field2 : "b"}',
+          aExpr("=", ident("a"),
+                objExpr([{ key: computedName(lit("field1")), value: lit("a") },
+                         { key: ident("field2"), value: lit("b") }])));
+
+assertExpr('a= {[1]: 1, 2 : 2}',
+          aExpr("=", ident("a"),
+                objExpr([{ key: computedName(lit(1)), value: lit(1) },
+                         { key: lit(2), value: lit(2) }])));
+
+// Bug 924688: computed property names - location information
+var node = Reflect.parse("a = {[field1]: 5}");
+Pattern({ body: [ { expression: { right: { properties: [ {key: { loc:
+    { start: { line: 1, column: 5 }, end: { line: 1, column: 13 }}}}]}}}]}).match(node);
+
+
 // statements
 
 assertStmt("throw 42", throwStmt(lit(42)));

js/src/vm/RegExpObject.cpp

@@ -7,6 +7,7 @@
 #include "vm/RegExpObject.h"
 
 #include "mozilla/MemoryReporting.h"
+#include "mozilla/PodOperations.h"
 
 #include "jsstr.h"
 
@@ -26,6 +27,7 @@ using namespace js;
 
 using mozilla::DebugOnly;
 using mozilla::Maybe;
+using mozilla::PodCopy;
 using js::frontend::TokenStream;
 
 using JS::AutoCheckCannotGC;
@@ -159,11 +161,7 @@ MatchPairs::initArrayFrom(MatchPairs &copyFrom)
     if (!allocOrExpandArray(copyFrom.pairCount()))
         return false;
 
-    for (size_t i = 0; i < pairCount_; i++) {
+    PodCopy(pairs_, copyFrom.pairs_, pairCount_);
-        JS_ASSERT(copyFrom[i].check());
-        pairs_[i].start = copyFrom[i].start;
-        pairs_[i].limit = copyFrom[i].limit;
-    }
 
     return true;
 }
@@ -552,8 +550,11 @@ RegExpShared::execute(JSContext *cx, HandleLinearString input, size_t *lastIndex
     if (!compileIfNecessary(cx, input))
         return RegExpRunStatus_Error;
 
-    /* Ensure sufficient memory for output vector. */
+    /*
-    if (!matches.initArray(pairCount()))
+     * Ensure sufficient memory for output vector.
+     * No need to initialize it. The RegExp engine fills them in on a match.
+     */
+    if (!matches.allocOrExpandArray(pairCount()))
         return RegExpRunStatus_Error;
 
     /*
@@ -577,6 +578,7 @@ RegExpShared::execute(JSContext *cx, HandleLinearString input, size_t *lastIndex
     irregexp::RegExpStackScope stackScope(cx->runtime());
 
     if (canStringMatch) {
+        JS_ASSERT(pairCount() == 1);
         int res = StringFindPattern(input, source, start + charsOffset);
         if (res == -1)
             return RegExpRunStatus_Success_NotFound;

js/src/vm/String.cpp

@@ -985,6 +985,16 @@ js::NewStringDontDeflate(ThreadSafeContext *cx, CharT *chars, size_t length)
         }
     }
 
+    if (JSFatInlineString::lengthFits<CharT>(length)) {
+        JSInlineString *str =
+            NewFatInlineString<allowGC>(cx, mozilla::Range<const CharT>(chars, length));
+        if (!str)
+            return nullptr;
+
+        js_free(chars);
+        return str;
+    }
+
     return JSFlatString::new_<allowGC>(cx, chars, length);
 }
 

js/xpconnect/loader/mozJSComponentLoader.cpp

@@ -28,7 +28,6 @@
 #include "nsIFile.h"
 #include "mozJSComponentLoader.h"
 #include "mozJSLoaderUtils.h"
-#include "nsIJSRuntimeService.h"
 #include "nsIXPConnect.h"
 #include "nsIObserverService.h"
 #include "nsIScriptSecurityManager.h"
@@ -42,7 +41,6 @@
 #include "xpcprivate.h"
 #include "xpcpublic.h"
 #include "nsContentUtils.h"
-#include "nsCxPusher.h"
 #include "WrapperFactory.h"
 
 #include "mozilla/AddonPathService.h"
@@ -50,6 +48,7 @@
 #include "mozilla/scache/StartupCacheUtils.h"
 #include "mozilla/MacroForEach.h"
 #include "mozilla/Preferences.h"
+#include "mozilla/dom/ScriptSettings.h"
 
 #include "js/OldDebugAPI.h"
 
@@ -74,7 +73,6 @@ static const JSClass kFakeBackstagePassJSClass =
     JS_ConvertStub
 };
 
-static const char kJSRuntimeServiceContractID[] = "@mozilla.org/js/xpc/RuntimeService;1";
 static const char kXPConnectServiceContractID[] = "@mozilla.org/js/xpc/XPConnect;1";
 static const char kObserverServiceContractID[] = "@mozilla.org/observer-service;1";
 static const char kJSCachePrefix[] = "jsloader";
@@ -239,12 +237,8 @@ public:
 
     void reportErrorAfterPop(char *buf);
 
-    operator JSContext*() const {return mContext;}
-
 private:
-
     JSContext* mContext;
-    nsCxPusher mPusher;
     char*      mBuf;
 
     // prevent copying and assignment
@@ -252,22 +246,6 @@ private:
     const JSCLContextHelper& operator=(const JSCLContextHelper &) MOZ_DELETE;
 };
 
-
-class JSCLAutoErrorReporterSetter
-{
-public:
-    JSCLAutoErrorReporterSetter(JSContext* cx, JSErrorReporter reporter)
-        {mContext = cx; mOldReporter = JS_SetErrorReporter(cx, reporter);}
-    ~JSCLAutoErrorReporterSetter()
-        {JS_SetErrorReporter(mContext, mOldReporter);}
-private:
-    JSContext* mContext;
-    JSErrorReporter mOldReporter;
-
-    JSCLAutoErrorReporterSetter(const JSCLAutoErrorReporterSetter &) MOZ_DELETE;
-    const JSCLAutoErrorReporterSetter& operator=(const JSCLAutoErrorReporterSetter &) MOZ_DELETE;
-};
-
 static nsresult
 ReportOnCaller(JSContext *callerContext,
                const char *format, ...) {
@@ -307,9 +285,7 @@ ReportOnCaller(JSCLContextHelper &helper,
 }
 
 mozJSComponentLoader::mozJSComponentLoader()
-    : mRuntime(nullptr),
+    : mModules(16),
-      mContext(nullptr),
-      mModules(16),
       mImports(16),
       mInProgressImports(16),
       mInitialized(false),
@@ -417,22 +393,6 @@ mozJSComponentLoader::ReallyInit()
     mReuseLoaderGlobal = true;
 #endif
 
-    /*
-     * Get the JSRuntime from the runtime svc, if possible.
-     * We keep a reference around, because it's a Bad Thing if the runtime
-     * service gets shut down before we're done.  Bad!
-     */
-
-    mRuntimeService = do_GetService(kJSRuntimeServiceContractID, &rv);
-    if (NS_FAILED(rv) ||
-        NS_FAILED(rv = mRuntimeService->GetRuntime(&mRuntime)))
-        return rv;
-
-    // Create our compilation context.
-    mContext = JS_NewContext(mRuntime, 256);
-    if (!mContext)
-        return NS_ERROR_OUT_OF_MEMORY;
-
     nsCOMPtr<nsIScriptSecurityManager> secman =
         do_GetService(NS_SCRIPTSECURITYMANAGER_CONTRACTID);
     if (!secman)
@@ -475,10 +435,12 @@ mozJSComponentLoader::LoadModule(FileLocation &aFile)
     if (mModules.Get(spec, &mod))
     return mod;
 
-    nsAutoPtr<ModuleEntry> entry(new ModuleEntry(mContext));
+    dom::AutoJSAPI jsapi;
+    jsapi.Init();
+    JSContext* cx = jsapi.cx();
 
-    JSAutoRequest ar(mContext);
+    nsAutoPtr<ModuleEntry> entry(new ModuleEntry(cx));
-    RootedValue dummy(mContext);
+    RootedValue dummy(cx);
     rv = ObjectForLocation(info, file, &entry->obj, &entry->thisObjectKey,
                            &entry->location, false, &dummy);
     if (NS_FAILED(rv)) {
@@ -495,7 +457,6 @@ mozJSComponentLoader::LoadModule(FileLocation &aFile)
     if (NS_FAILED(rv))
         return nullptr;
 
-    JSCLContextHelper cx(mContext);
     JSAutoCompartment ac(cx, entry->obj);
 
     nsCOMPtr<nsIXPConnectJSObjectHolder> cm_holder;
@@ -527,8 +488,6 @@ mozJSComponentLoader::LoadModule(FileLocation &aFile)
         return nullptr;
     }
 
-    JSCLAutoErrorReporterSetter aers(cx, xpc::SystemErrorReporter);
-
     RootedValue NSGetFactory_val(cx);
     if (!JS_GetProperty(cx, entryObj, "NSGetFactory", &NSGetFactory_val) ||
         NSGetFactory_val.isUndefined()) {
@@ -660,7 +619,7 @@ class ANSIFileAutoCloser
 #endif
 
 JSObject*
-mozJSComponentLoader::PrepareObjectForLocation(JSCLContextHelper& aCx,
+mozJSComponentLoader::PrepareObjectForLocation(JSContext* aCx,
                                                nsIFile *aComponentFile,
                                                nsIURI *aURI,
                                                bool aReuseLoaderGlobal,
@@ -767,8 +726,11 @@ mozJSComponentLoader::PrepareObjectForLocation(JSCLContextHelper& aCx,
         return nullptr;
 
     if (createdNewGlobal) {
-        RootedObject global(aCx, holder->GetJSObject());
+        // AutoEntryScript required to invoke debugger hook, which is a
-        JS_FireOnNewGlobalObject(aCx, global);
+        // Gecko-specific concept at present.
+        dom::AutoEntryScript aes(GetNativeForGlobal(holder->GetJSObject()));
+        RootedObject global(aes.cx(), holder->GetJSObject());
+        JS_FireOnNewGlobalObject(aes.cx(), global);
     }
 
     return obj;
@@ -783,11 +745,11 @@ mozJSComponentLoader::ObjectForLocation(ComponentLoaderInfo &aInfo,
                                         bool aPropagateExceptions,
                                         MutableHandleValue aException)
 {
-    JSCLContextHelper cx(mContext);
+    MOZ_ASSERT(NS_IsMainThread(), "Must be on main thread.");
 
-    JS_AbortIfWrongThread(JS_GetRuntime(cx));
+    dom::AutoJSAPI jsapi;
-
+    jsapi.Init();
-    JSCLAutoErrorReporterSetter aers(cx, xpc::SystemErrorReporter);
+    JSContext* cx = jsapi.cx();
 
     bool realFile = false;
     nsresult rv = aInfo.EnsureURI();
@@ -1041,6 +1003,10 @@ mozJSComponentLoader::ObjectForLocation(ComponentLoaderInfo &aInfo,
     bool ok = false;
 
     {
+        // We're going to run script via JS_ExecuteScriptVersion or
+        // JS_CallFunction, so we need an AutoEntryScript.
+        // This is Gecko-specific and not in any spec.
+        dom::AutoEntryScript aes(GetNativeForGlobal(CurrentGlobalOrNull(cx)));
         AutoSaveContextOptions asco(cx);
         if (aPropagateExceptions)
             ContextOptionsRef(cx).setDontReportUncaught(true);
@@ -1088,11 +1054,13 @@ mozJSComponentLoader::UnloadModules()
     if (mLoaderGlobal) {
         MOZ_ASSERT(mReuseLoaderGlobal, "How did this happen?");
 
-        JSAutoRequest ar(mContext);
+        dom::AutoJSAPI jsapi;
-        RootedObject global(mContext, mLoaderGlobal->GetJSObject());
+        jsapi.Init();
+        JSContext* cx = jsapi.cx();
+        RootedObject global(cx, mLoaderGlobal->GetJSObject());
         if (global) {
-            JSAutoCompartment ac(mContext, global);
+            JSAutoCompartment ac(cx, global);
-            JS_SetAllNonReservedSlotsToUndefined(mContext, global);
+            JS_SetAllNonReservedSlotsToUndefined(cx, global);
         } else {
             NS_WARNING("Going to leak!");
         }
@@ -1104,11 +1072,6 @@ mozJSComponentLoader::UnloadModules()
     mImports.Clear();
 
     mModules.Enumerate(ClearModules, nullptr);
-
-    JS_DestroyContextNoGC(mContext);
-    mContext = nullptr;
-
-    mRuntimeService = nullptr;
 }
 
 NS_IMETHODIMP
@@ -1298,28 +1261,37 @@ mozJSComponentLoader::ImportInto(const nsACString &aLocation,
     vp.set(mod->obj);
 
     if (targetObj) {
-        JSCLContextHelper cxhelper(mContext);
+        // cxhelper must be created before jsapi, so that jsapi is detroyed and
-        JSAutoCompartment ac(mContext, mod->obj);
+        // pops any context it has pushed before we report to the caller context.
+        JSCLContextHelper cxhelper(callercx);
 
-        RootedValue symbols(mContext);
+        // Even though we are calling JS_SetPropertyById on targetObj, we want
-        RootedObject modObj(mContext, mod->obj);
+        // to ensure that we never run script here, so we use an AutoJSAPI and
-        if (!JS_GetProperty(mContext, modObj,
+        // not an AutoEntryScript.
+        dom::AutoJSAPI jsapi;
+        jsapi.Init();
+        JSContext* cx = jsapi.cx();
+        JSAutoCompartment ac(cx, mod->obj);
+
+        RootedValue symbols(cx);
+        RootedObject modObj(cx, mod->obj);
+        if (!JS_GetProperty(cx, modObj,
                             "EXPORTED_SYMBOLS", &symbols)) {
             return ReportOnCaller(cxhelper, ERROR_NOT_PRESENT,
                                   PromiseFlatCString(aLocation).get());
         }
 
-        if (!JS_IsArrayObject(mContext, symbols)) {
+        if (!JS_IsArrayObject(cx, symbols)) {
             return ReportOnCaller(cxhelper, ERROR_NOT_AN_ARRAY,
                                   PromiseFlatCString(aLocation).get());
         }
 
-        RootedObject symbolsObj(mContext, &symbols.toObject());
+        RootedObject symbolsObj(cx, &symbols.toObject());
 
         // Iterate over symbols array, installing symbols on targetObj:
 
         uint32_t symbolCount = 0;
-        if (!JS_GetArrayLength(mContext, symbolsObj, &symbolCount)) {
+        if (!JS_GetArrayLength(cx, symbolsObj, &symbolCount)) {
             return ReportOnCaller(cxhelper, ERROR_GETTING_ARRAY_LENGTH,
                                   PromiseFlatCString(aLocation).get());
         }
@@ -1328,19 +1300,19 @@ mozJSComponentLoader::ImportInto(const nsACString &aLocation,
         nsAutoCString logBuffer;
 #endif
 
-        RootedValue value(mContext);
+        RootedValue value(cx);
-        RootedId symbolId(mContext);
+        RootedId symbolId(cx);
         for (uint32_t i = 0; i < symbolCount; ++i) {
-            if (!JS_GetElement(mContext, symbolsObj, i, &value) ||
+            if (!JS_GetElement(cx, symbolsObj, i, &value) ||
                 !value.isString() ||
-                !JS_ValueToId(mContext, value, &symbolId)) {
+                !JS_ValueToId(cx, value, &symbolId)) {
                 return ReportOnCaller(cxhelper, ERROR_ARRAY_ELEMENT,
                                       PromiseFlatCString(aLocation).get(), i);
             }
 
-            RootedObject modObj(mContext, mod->obj);
+            RootedObject modObj(cx, mod->obj);
-            if (!JS_GetPropertyById(mContext, modObj, symbolId, &value)) {
+            if (!JS_GetPropertyById(cx, modObj, symbolId, &value)) {
-                JSAutoByteString bytes(mContext, JSID_TO_STRING(symbolId));
+                JSAutoByteString bytes(cx, JSID_TO_STRING(symbolId));
                 if (!bytes)
                     return NS_ERROR_FAILURE;
                 return ReportOnCaller(cxhelper, ERROR_GETTING_SYMBOL,
@@ -1348,11 +1320,11 @@ mozJSComponentLoader::ImportInto(const nsACString &aLocation,
                                       bytes.ptr());
             }
 
-            JSAutoCompartment target_ac(mContext, targetObj);
+            JSAutoCompartment target_ac(cx, targetObj);
 
-            if (!JS_WrapValue(mContext, &value) ||
+            if (!JS_WrapValue(cx, &value) ||
-                !JS_SetPropertyById(mContext, targetObj, symbolId, value)) {
+                !JS_SetPropertyById(cx, targetObj, symbolId, value)) {
-                JSAutoByteString bytes(mContext, JSID_TO_STRING(symbolId));
+                JSAutoByteString bytes(cx, JSID_TO_STRING(symbolId));
                 if (!bytes)
                     return NS_ERROR_FAILURE;
                 return ReportOnCaller(cxhelper, ERROR_SETTING_SYMBOL,
@@ -1363,7 +1335,7 @@ mozJSComponentLoader::ImportInto(const nsACString &aLocation,
             if (i == 0) {
                 logBuffer.AssignLiteral("Installing symbols [ ");
             }
-            JSAutoByteString bytes(mContext, JSID_TO_STRING(symbolId));
+            JSAutoByteString bytes(cx, JSID_TO_STRING(symbolId));
             if (!!bytes)
                 logBuffer.Append(bytes.ptr());
             logBuffer.Append(' ');
@@ -1450,20 +1422,12 @@ JSCLContextHelper::JSCLContextHelper(JSContext* aCx)
     : mContext(aCx)
     , mBuf(nullptr)
 {
-    mPusher.Push(mContext);
-    JS_BeginRequest(mContext);
 }
 
 JSCLContextHelper::~JSCLContextHelper()
 {
-    JS_EndRequest(mContext);
-    mPusher.Pop();
-    JSContext *restoredCx = nsContentUtils::GetCurrentJSContext();
-    if (restoredCx && mBuf) {
-        JS_ReportError(restoredCx, mBuf);
-    }
-
     if (mBuf) {
+        JS_ReportError(mContext, mBuf);
         JS_smprintf_free(mBuf);
     }
 }

js/xpconnect/loader/mozJSComponentLoader.h

@@ -21,7 +21,6 @@
 #include "xpcIJSGetFactory.h"
 
 class nsIFile;
-class nsIJSRuntimeService;
 class nsIPrincipal;
 class nsIXPConnectJSObjectHolder;
 class ComponentLoaderInfo;
@@ -33,13 +32,10 @@ class ComponentLoaderInfo;
     { 0xbb, 0xef, 0xf0, 0xcc, 0xb5, 0xfa, 0x64, 0xb6 }}
 #define MOZJSCOMPONENTLOADER_CONTRACTID "@mozilla.org/moz/jsloader;1"
 
-class JSCLContextHelper;
-
 class mozJSComponentLoader : public mozilla::ModuleLoader,
                              public xpcIJSModuleLoader,
                              public nsIObserver
 {
-    friend class JSCLContextHelper;
  public:
     NS_DECL_ISUPPORTS
     NS_DECL_XPCIJSMODULELOADER
@@ -65,7 +61,7 @@ class mozJSComponentLoader : public mozilla::ModuleLoader,
     nsresult ReallyInit();
     void UnloadModules();
 
-    JSObject* PrepareObjectForLocation(JSCLContextHelper& aCx,
+    JSObject* PrepareObjectForLocation(JSContext* aCx,
                                        nsIFile* aComponentFile,
                                        nsIURI *aComponent,
                                        bool aReuseLoaderGlobal,
@@ -85,11 +81,8 @@ class mozJSComponentLoader : public mozilla::ModuleLoader,
                         JS::MutableHandleObject vp);
 
     nsCOMPtr<nsIComponentManager> mCompMgr;
-    nsCOMPtr<nsIJSRuntimeService> mRuntimeService;
     nsCOMPtr<nsIPrincipal> mSystemPrincipal;
     nsCOMPtr<nsIXPConnectJSObjectHolder> mLoaderGlobal;
-    JSRuntime *mRuntime;
-    JSContext *mContext;
 
     class ModuleEntry : public mozilla::Module
     {

js/xpconnect/src/XPCShellImpl.cpp

@@ -9,6 +9,7 @@
 #include "jsfriendapi.h"
 #include "jsprf.h"
 #include "js/OldDebugAPI.h"
+#include "mozilla/dom/ScriptSettings.h"
 #include "nsServiceManagerUtils.h"
 #include "nsComponentManagerUtils.h"
 #include "nsIXPConnect.h"
@@ -29,7 +30,6 @@
 #include "nsJSPrincipals.h"
 #include "xpcpublic.h"
 #include "BackstagePass.h"
-#include "nsCxPusher.h"
 #include "nsIScriptSecurityManager.h"
 #include "nsIPrincipal.h"
 #include "nsJSUtils.h"
@@ -1461,11 +1461,9 @@ XRE_XPCShellMain(int argc, char **argv, char **envp)
         sScriptedInterruptCallback.construct(rt, UndefinedValue());
         JS_SetInterruptCallback(rt, XPCShellInterruptCallback);
 
-        cx = JS_NewContext(rt, 8192);
+        dom::AutoJSAPI jsapi;
-        if (!cx) {
+        jsapi.Init();
-            printf("JS_NewContext failed!\n");
+        cx = jsapi.cx();
-            return 1;
-        }
 
         argc--;
         argv++;
@@ -1510,9 +1508,6 @@ XRE_XPCShellMain(int argc, char **argv, char **envp)
         xpc->SetFunctionThisTranslator(NS_GET_IID(nsITestXPCFunctionCallback), translator);
 #endif
 
-        nsCxPusher pusher;
-        pusher.Push(cx);
-
         nsRefPtr<BackstagePass> backstagePass;
         rv = NS_NewBackstagePass(getter_AddRefs(backstagePass));
         if (NS_FAILED(rv)) {
@@ -1552,20 +1547,17 @@ XRE_XPCShellMain(int argc, char **argv, char **envp)
             JSAutoCompartment ac(cx, glob);
 
             if (!JS_InitReflect(cx, glob)) {
-                JS_EndRequest(cx);
                 return 1;
             }
 
             if (!JS_DefineFunctions(cx, glob, glob_functions) ||
                 !JS_DefineProfilingFunctions(cx, glob)) {
-                JS_EndRequest(cx);
                 return 1;
             }
 
             JS::Rooted<JSObject*> envobj(cx);
             envobj = JS_DefineObject(cx, glob, "environment", &env_class);
             if (!envobj) {
-                JS_EndRequest(cx);
                 return 1;
             }
 
@@ -1578,15 +1570,16 @@ XRE_XPCShellMain(int argc, char **argv, char **envp)
             JS_DefineProperty(cx, glob, "__LOCATION__", JS::UndefinedHandleValue, 0,
                               GetLocationProperty, nullptr);
 
-            result = ProcessArgs(cx, glob, argv, argc, &dirprovider);
+            // We are almost certainly going to run script here, so we need an
+            // AutoEntryScript. This is Gecko-specific and not in any spec.
+            dom::AutoEntryScript aes(backstagePass);
+            result = ProcessArgs(aes.cx(), glob, argv, argc, &dirprovider);
 
             JS_DropPrincipals(rt, gJSPrincipals);
-            JS_SetAllNonReservedSlotsToUndefined(cx, glob);
+            JS_SetAllNonReservedSlotsToUndefined(aes.cx(), glob);
             JS_GC(rt);
         }
-        pusher.Pop();
         JS_GC(rt);
-        JS_DestroyContext(cx);
     } // this scopes the nsCOMPtrs
 
     if (!XRE_ShutdownTestShell())

layout/base/TouchCaret.cpp

@@ -569,7 +569,7 @@ TouchCaret::HandleEvent(WidgetEvent* aEvent)
     case NS_TOUCH_END:
       status = HandleTouchUpEvent(aEvent->AsTouchEvent());
       break;
-   case NS_MOUSE_BUTTON_UP:
+    case NS_MOUSE_BUTTON_UP:
       status = HandleMouseUpEvent(aEvent->AsMouseEvent());
       break;
     case NS_TOUCH_MOVE:
@@ -586,9 +586,11 @@ TouchCaret::HandleEvent(WidgetEvent* aEvent)
     case NS_KEY_UP:
     case NS_KEY_DOWN:
     case NS_KEY_PRESS:
-    case NS_WHEEL_EVENT_START:
+    case NS_WHEEL_WHEEL:
+    case NS_WHEEL_START:
+    case NS_WHEEL_STOP:
       // Disable touch caret while key/wheel event is received.
-      TOUCHCARET_LOG("Receive key/wheel event");
+      TOUCHCARET_LOG("Receive key/wheel event %d", aEvent->message);
       SetVisibility(false);
       break;
     default:

layout/base/nsLayoutUtils.cpp

@@ -6763,7 +6763,7 @@ nsLayoutUtils::CalculateScrollableRectForFrame(nsIScrollableFrame* aScrollableFr
     // provide the special behaviour, this code will cause it to break. We can remove
     // the ifndef once Fennec switches over to APZ or if we add the special handling
     // to Fennec
-#ifndef MOZ_WIDGET_ANDROID
+#if !defined(MOZ_WIDGET_ANDROID) || defined(MOZ_ANDROID_APZ)
     nsPoint scrollPosition = aScrollableFrame->GetScrollPosition();
     if (aScrollableFrame->GetScrollbarStyles().mVertical == NS_STYLE_OVERFLOW_HIDDEN) {
       contentBounds.y = scrollPosition.y;

layout/base/nsPresContext.cpp

@@ -62,7 +62,6 @@
 #include "nsFrameLoader.h"
 
 #include "nsContentUtils.h"
-#include "nsCxPusher.h"
 #include "nsPIWindowRoot.h"
 #include "mozilla/Preferences.h"
 
@@ -1931,17 +1930,11 @@ nsPresContext::MediaFeatureValuesChanged(StyleRebuildType aShouldRebuild,
     }
 
     if (!notifyList.IsEmpty()) {
-      nsPIDOMWindow *win = mDocument->GetInnerWindow();
-      nsCOMPtr<EventTarget> et = do_QueryInterface(win);
-      nsCxPusher pusher;
-
       for (uint32_t i = 0, i_end = notifyList.Length(); i != i_end; ++i) {
-        if (pusher.RePush(et)) {
+        nsAutoMicroTask mt;
-          nsAutoMicroTask mt;
+        MediaQueryList::HandleChangeData &d = notifyList[i];
-          MediaQueryList::HandleChangeData &d = notifyList[i];
+        ErrorResult result;
-          ErrorResult result;
+        d.callback->Call(*d.mql, result);
-          d.callback->Call(*d.mql, result);
-        }
       }
     }
 

layout/base/tests/marionette/test_touchcaret.py

@@ -147,6 +147,38 @@ class TouchCaretTest(MarionetteTestCase):
         el.send_keys(content_to_add)
         assertFunc(non_target_content, sel.content)
 
+    def _test_touch_caret_hides_after_receiving_wheel_event(self, el, assertFunc):
+        sel = SelectionManager(el)
+        content_to_add = '!'
+        non_target_content = content_to_add + sel.content
+
+        # Tap to make touch caret appear. Note: it's strange that when the caret
+        # is at the end, the rect of the caret in <textarea> cannot be obtained.
+        # A bug perhaps.
+        el.tap()
+        sel.move_caret_to_end()
+        sel.move_caret_by_offset(1, backward=True)
+        el.tap(*sel.caret_location())
+
+        # Send an arbitrary scroll-down-10px wheel event to the center of the
+        # input box to hide touch caret. Then pretend to move it to the top-left
+        # corner of the input box.
+        src_x, src_y = sel.touch_caret_location()
+        dest_x, dest_y = 0, 0
+        el_center_x, el_center_y = el.rect['x'], el.rect['y']
+        self.marionette.execute_script(
+            '''var utils = SpecialPowers.getDOMWindowUtils(window);
+            utils.sendWheelEvent(arguments[0], arguments[1],
+                                 0, 10, 0, WheelEvent.DOM_DELTA_PIXEL,
+                                 0, 0, 0, 0);''',
+            script_args=[el_center_x, el_center_y]
+        )
+        self.actions.flick(el, src_x, src_y, dest_x, dest_y).perform()
+
+        el.send_keys(content_to_add)
+        assertFunc(non_target_content, sel.content)
+
+
     ########################################################################
     # <input> test cases with touch caret enabled
     ########################################################################
@@ -166,6 +198,10 @@ class TouchCaretTest(MarionetteTestCase):
         self.openTestHtml(enabled=True)
         self._test_touch_caret_timeout_by_dragging_it_to_top_left_corner_after_timout(self._input, self.assertNotEqual)
 
+    def test_input_touch_caret_hides_after_receiving_wheel_event(self):
+        self.openTestHtml(enabled=True, expiration_time=0)
+        self._test_touch_caret_hides_after_receiving_wheel_event(self._input, self.assertNotEqual)
+
     ########################################################################
     # <input> test cases with touch caret disabled
     ########################################################################
@@ -196,6 +232,10 @@ class TouchCaretTest(MarionetteTestCase):
         self.openTestHtml(enabled=True)
         self._test_touch_caret_timeout_by_dragging_it_to_top_left_corner_after_timout(self._textarea, self.assertNotEqual)
 
+    def test_textarea_touch_caret_hides_after_receiving_wheel_event(self):
+        self.openTestHtml(enabled=True, expiration_time=0)
+        self._test_touch_caret_hides_after_receiving_wheel_event(self._textarea, self.assertNotEqual)
+
     ########################################################################
     # <textarea> test cases with touch caret disabled
     ########################################################################
@@ -226,6 +266,10 @@ class TouchCaretTest(MarionetteTestCase):
         self.openTestHtml(enabled=True)
         self._test_touch_caret_timeout_by_dragging_it_to_top_left_corner_after_timout(self._contenteditable, self.assertNotEqual)
 
+    def test_contenteditable_touch_caret_hides_after_receiving_wheel_event(self):
+        self.openTestHtml(enabled=True, expiration_time=0)
+        self._test_touch_caret_hides_after_receiving_wheel_event(self._contenteditable, self.assertNotEqual)
+
     ########################################################################
     # <div> contenteditable test cases with touch caret disabled
     ########################################################################

layout/reftests/w3c-css/submitted/flexbox/flexbox-abspos-child-1a.html

@@ -7,7 +7,7 @@
 <head>
   <title>CSS Test: Testing that "min-width", "max-width", "min-height", and "max-height" are applied on absolutely positioned children of a horizontal flex container</title>
   <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com">
-  <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#abspos-items">
+  <link rel="help" href="http://www.w3.org/TR/css-flexbox-1/#abspos-items">
   <link rel="match" href="flexbox-abspos-child-1-ref.html">
   <meta charset="utf-8">
   <style>

layout/reftests/w3c-css/submitted/flexbox/flexbox-abspos-child-1b.html

@@ -7,7 +7,7 @@
 <head>
   <title>CSS Test: Testing that "min-width", "max-width", "min-height", and "max-height" are applied on absolutely positioned children of a vertical flex container</title>
   <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com">
-  <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#abspos-items">
+  <link rel="help" href="http://www.w3.org/TR/css-flexbox-1/#abspos-items">
   <link rel="match" href="flexbox-abspos-child-1-ref.html">
   <meta charset="utf-8">
   <style>

layout/reftests/w3c-css/submitted/flexbox/flexbox-align-content-horiz-1a.xhtml

@@ -9,7 +9,7 @@
   <head>
     <title>CSS Test: Testing 'align-content' in a horizontal flex container</title>
     <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com"/>
-    <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#align-content-property"/>
+    <link rel="help" href="http://www.w3.org/TR/css-flexbox-1/#align-content-property"/>
     <link rel="match" href="flexbox-align-content-horiz-1-ref.xhtml"/>
     <style>
       div.flexbox {

layout/reftests/w3c-css/submitted/flexbox/flexbox-align-content-horiz-1b.xhtml

@@ -10,7 +10,7 @@
   <head>
     <title>CSS Test: Testing 'align-content' in a horizontal flex container</title>
     <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com"/>
-    <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#align-content-property"/>
+    <link rel="help" href="http://www.w3.org/TR/css-flexbox-1/#align-content-property"/>
     <link rel="match" href="flexbox-align-content-horiz-1-ref.xhtml"/>
     <style>
       div.flexbox {

layout/reftests/w3c-css/submitted/flexbox/flexbox-align-content-vert-1a.xhtml

@@ -9,7 +9,7 @@
   <head>
     <title>CSS Test: Testing 'align-content' in a vertical flex container</title>
     <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com"/>
-    <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#align-content-property"/>
+    <link rel="help" href="http://www.w3.org/TR/css-flexbox-1/#align-content-property"/>
     <link rel="match" href="flexbox-align-content-vert-1-ref.xhtml"/>
     <style>
       div.flexbox {

layout/reftests/w3c-css/submitted/flexbox/flexbox-align-content-vert-1b.xhtml

@@ -10,7 +10,7 @@
   <head>
     <title>CSS Test: Testing 'align-content' in a vertical flex container</title>
     <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com"/>
-    <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#align-content-property"/>
+    <link rel="help" href="http://www.w3.org/TR/css-flexbox-1/#align-content-property"/>
     <link rel="match" href="flexbox-align-content-vert-1-ref.xhtml"/>
     <style>
       div.flexbox {

layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-baseline-horiz-1a.xhtml

@@ -12,7 +12,7 @@
   <head>
     <title>CSS Test: Baseline alignment of block flex items with 'baseline' value for 'align-items' / 'align-self'</title>
     <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com"/>
-    <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#baseline-participation"/>
+    <link rel="help" href="http://www.w3.org/TR/css-flexbox-1/#baseline-participation"/>
     <link rel="match" href="flexbox-align-self-baseline-horiz-1-ref.xhtml"/>
     <style>
       .flexbox {

layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-baseline-horiz-1b.xhtml

@@ -14,7 +14,7 @@
   <head>
     <title>CSS Test: Baseline alignment of block flex items with 'baseline' value for 'align-items' / 'align-self' in a wrap-reverse flex container</title>
     <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com"/>
-    <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#baseline-participation"/>
+    <link rel="help" href="http://www.w3.org/TR/css-flexbox-1/#baseline-participation"/>
     <link rel="match" href="flexbox-align-self-baseline-horiz-1-ref.xhtml"/>
     <style>
       .flexbox {

layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-baseline-horiz-2.xhtml

@@ -10,7 +10,7 @@
   <head>
     <title>CSS Test: Baseline alignment of flex items in fixed-size single-line flex container</title>
     <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com"/>
-    <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#baseline-participation"/>
+    <link rel="help" href="http://www.w3.org/TR/css-flexbox-1/#baseline-participation"/>
     <link rel="match" href="flexbox-align-self-baseline-horiz-2-ref.xhtml"/>
     <style>
       .flexbox {

layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-baseline-horiz-3.xhtml

@@ -11,7 +11,7 @@
   <head>
     <title>CSS Test: Baseline alignment of flex items in fixed-size single-line flex container, with cross axis reversed</title>
     <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com"/>
-    <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#baseline-participation"/>
+    <link rel="help" href="http://www.w3.org/TR/css-flexbox-1/#baseline-participation"/>
     <link rel="match" href="flexbox-align-self-baseline-horiz-3-ref.xhtml"/>
     <style>
       .flexbox {

layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-baseline-horiz-4.xhtml

@@ -12,7 +12,7 @@
   <head>
     <title>CSS Test: Baseline alignment of block flex items with 'baseline' value for 'align-items' / 'align-self' in a multi-line flex container</title>
     <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com"/>
-    <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#baseline-participation"/>
+    <link rel="help" href="http://www.w3.org/TR/css-flexbox-1/#baseline-participation"/>
     <link rel="match" href="flexbox-align-self-baseline-horiz-4-ref.xhtml"/>
     <style>
       .flexbox {

layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-baseline-horiz-5.xhtml

@@ -12,7 +12,7 @@
   <head>
     <title>CSS Test: Baseline alignment of block flex items with 'baseline' value for 'align-items' / 'align-self' in a multi-line flex container</title>
     <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com"/>
-    <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#baseline-participation"/>
+    <link rel="help" href="http://www.w3.org/TR/css-flexbox-1/#baseline-participation"/>
     <link rel="match" href="flexbox-align-self-baseline-horiz-5-ref.xhtml"/>
     <style>
       .flexbox {

layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-horiz-1-block.xhtml

@@ -9,7 +9,7 @@
   <head>
     <title>CSS Test: Testing the behavior of 'align-self' property values on flex items that are blocks, in a horizontal flex container</title>
     <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com"/>
-    <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#align-items-property"/>
+    <link rel="help" href="http://www.w3.org/TR/css-flexbox-1/#align-items-property"/>
     <link rel="match" href="flexbox-align-self-horiz-1-ref.xhtml"/>
     <style>
       .flexbox {

layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-horiz-1-table.xhtml

@@ -9,7 +9,7 @@
   <head>
     <title>CSS Test: Testing the various 'align-self' property values on flex items that are tables</title>
     <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com"/>
-    <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#align-items-property"/>
+    <link rel="help" href="http://www.w3.org/TR/css-flexbox-1/#align-items-property"/>
     <link rel="match" href="flexbox-align-self-horiz-1-ref.xhtml"/>
     <style>
       .flexbox {

layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-horiz-2.xhtml

@@ -10,7 +10,7 @@
   <head>
     <title>CSS Test: Testing the behavior of 'align-self' with a horizontal flex container, with margin/padding/border on the items</title>
     <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com"/>
-    <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#align-items-property"/>
+    <link rel="help" href="http://www.w3.org/TR/css-flexbox-1/#align-items-property"/>
     <link rel="match" href="flexbox-align-self-horiz-2-ref.xhtml"/>
     <style>
       .flexbox {

layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-horiz-3.xhtml

@@ -10,7 +10,7 @@
   <head>
     <title>CSS Test: Testing the behavior of 'align-self' with a horizontal flex container that's shorter than its items</title>
     <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com"/>
-    <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#align-items-property"/>
+    <link rel="help" href="http://www.w3.org/TR/css-flexbox-1/#align-items-property"/>
     <link rel="match" href="flexbox-align-self-horiz-3-ref.xhtml"/>
     <style>
       .flexbox {

layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-horiz-4.xhtml

@@ -10,7 +10,7 @@
   <head>
     <title>CSS Test: Testing the behavior of 'align-self' with a horizontal flex container that's shorter than its items, with margin/padding/border on the items</title>
     <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com"/>
-    <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#align-items-property"/>
+    <link rel="help" href="http://www.w3.org/TR/css-flexbox-1/#align-items-property"/>
     <link rel="match" href="flexbox-align-self-horiz-4-ref.xhtml"/>
     <style>
       .flexbox {

layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-horiz-5.xhtml

@@ -11,7 +11,7 @@
   <head>
     <title>CSS Test: Testing the behavior of 'align-self' with auto margins in play, in a horizontal flex container</title>
     <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com"/>
-    <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#auto-margins"/>
+    <link rel="help" href="http://www.w3.org/TR/css-flexbox-1/#auto-margins"/>
     <link rel="match" href="flexbox-align-self-horiz-5-ref.xhtml"/>
     <style>
       .flexbox {

layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-stretch-vert-1.html

@@ -7,7 +7,7 @@
 <head>
   <title>CSS Test: Testing the sizing of a stretched horizontal flex container in a vertical flex container</title>
   <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com">
-  <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#layout-algorithm">
+  <link rel="help" href="http://www.w3.org/TR/css-flexbox-1/#layout-algorithm">
   <link rel="match" href="flexbox-align-self-stretch-vert-1-ref.html">
   <meta name="assert" content="If a stretched flex item's main size is influenced by its cross size, and the flex container has a definite cross size, then the item's cross size should be resolved early so that it can be used when determining the item's main size">
   <meta name="assert" content="http://dev.w3.org/csswg/css-flexbox/issues-cr-2012#issue-23">

layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-stretch-vert-2.html

@@ -7,7 +7,7 @@
 <head>
   <title>CSS Test: Testing the sizing of stretched flex items in a vertical multi-line flex container</title>
   <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com">
-  <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#layout-algorithm">
+  <link rel="help" href="http://www.w3.org/TR/css-flexbox-1/#layout-algorithm">
   <link rel="match" href="flexbox-align-self-stretch-vert-2-ref.html">
   <meta name="assert" content="In a multi-line flex container, flex items should not be stretched (in the cross axis) until after wrapping has been performed.">
   <meta charset="utf-8">

layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-vert-1.xhtml

@@ -9,7 +9,7 @@
   <head>
     <title>CSS Test: Testing the behavior of 'align-self' property values on flex items that are blocks, in a vertical flex container</title>
     <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com"/>
-    <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#align-items-property"/>
+    <link rel="help" href="http://www.w3.org/TR/css-flexbox-1/#align-items-property"/>
     <link rel="match" href="flexbox-align-self-vert-1-ref.xhtml"/>
     <style>
       .flexbox {

layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-vert-2.xhtml

@@ -10,7 +10,7 @@
   <head>
     <title>CSS Test: Testing the behavior of 'align-self' with a vertical flex container, with margin/padding/border on the items</title>
     <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com"/>
-    <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#align-items-property"/>
+    <link rel="help" href="http://www.w3.org/TR/css-flexbox-1/#align-items-property"/>
     <link rel="match" href="flexbox-align-self-vert-2-ref.xhtml"/>
     <style>
       .flexbox {

layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-vert-3.xhtml

@@ -10,7 +10,7 @@
   <head>
     <title>CSS Test: Testing the behavior of 'align-self' with a vertical flex container that's skinnier than its items</title>
     <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com"/>
-    <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#align-items-property"/>
+    <link rel="help" href="http://www.w3.org/TR/css-flexbox-1/#align-items-property"/>
     <link rel="match" href="flexbox-align-self-vert-3-ref.xhtml"/>
     <style>
       .flexbox {

layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-vert-4.xhtml

@@ -10,7 +10,7 @@
   <head>
     <title>CSS Test: Testing the behavior of 'align-self' with a vertical flex container that's skinnier than its items, with margin/padding/border on the items</title>
     <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com"/>
-    <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#align-items-property"/>
+    <link rel="help" href="http://www.w3.org/TR/css-flexbox-1/#align-items-property"/>
     <link rel="match" href="flexbox-align-self-vert-4-ref.xhtml"/>
     <style>
       .flexbox {

layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-vert-rtl-1.xhtml

@@ -10,7 +10,7 @@
   <head>
     <title>CSS Test: Testing the behavior of 'align-self' property values on flex items that are blocks, in a vertical flex container with 'direction: rtl'</title>
     <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com"/>
-    <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#align-items-property"/>
+    <link rel="help" href="http://www.w3.org/TR/css-flexbox-1/#align-items-property"/>
     <link rel="match" href="flexbox-align-self-vert-rtl-1-ref.xhtml"/>
     <style>
       .flexbox {

layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-vert-rtl-2.xhtml

@@ -11,7 +11,7 @@
   <head>
     <title>CSS Test: Testing the behavior of 'align-self' with a vertical flex container, with margin/padding/border on the items and with 'direction: rtl'</title>
     <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com"/>
-    <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#align-items-property"/>
+    <link rel="help" href="http://www.w3.org/TR/css-flexbox-1/#align-items-property"/>
     <link rel="match" href="flexbox-align-self-vert-rtl-2-ref.xhtml"/>
     <style>
       .flexbox {

layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-vert-rtl-3.xhtml

@@ -11,7 +11,7 @@
   <head>
     <title>CSS Test: Testing the behavior of 'align-self' with a vertical flex container that's skinnier than its items and  with 'direction: rtl'</title>
     <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com"/>
-    <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#align-items-property"/>
+    <link rel="help" href="http://www.w3.org/TR/css-flexbox-1/#align-items-property"/>
     <link rel="match" href="flexbox-align-self-vert-rtl-3-ref.xhtml"/>
     <style>
       .flexbox {

layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-vert-rtl-4.xhtml

@@ -11,7 +11,7 @@
   <head>
     <title>CSS Test: Testing the behavior of 'align-self' with a vertical flex container that's skinnier than its items, with margin/padding/border on the items and with 'direction: rtl'</title>
     <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com"/>
-    <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#align-items-property"/>
+    <link rel="help" href="http://www.w3.org/TR/css-flexbox-1/#align-items-property"/>
     <link rel="match" href="flexbox-align-self-vert-rtl-4-ref.xhtml"/>
     <style>
       .flexbox {

layout/reftests/w3c-css/submitted/flexbox/flexbox-anonymous-items-1.html

@@ -7,7 +7,7 @@
 <head>
   <title>CSS Test: Testing that we gracefully handle cases where two anonymous flex items become adjacent due to "order" reordering</title>
   <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com">
-  <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#flex-items">
+  <link rel="help" href="http://www.w3.org/TR/css-flexbox-1/#flex-items">
   <link rel="match" href="flexbox-anonymous-items-1-ref.html">
   <meta charset="utf-8">
   <style>

layout/reftests/w3c-css/submitted/flexbox/flexbox-baseline-align-self-baseline-horiz-1.html

@@ -14,7 +14,7 @@
 <head>
   <title>CSS Test: Testing the baseline of a horizontal flex container with baseline-aligned flex items</title>
   <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com">
-  <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#flex-baselines">
+  <link rel="help" href="http://www.w3.org/TR/css-flexbox-1/#flex-baselines">
   <link rel="match" href="flexbox-baseline-align-self-baseline-horiz-1-ref.html">
   <meta charset="utf-8">
   <style>

layout/reftests/w3c-css/submitted/flexbox/flexbox-baseline-align-self-baseline-vert-1.html

@@ -14,7 +14,7 @@
 <head>
   <title>CSS Test: Testing the baseline of a vertical flex container with baseline-aligned flex items</title>
   <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com">
-  <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#flex-baselines">
+  <link rel="help" href="http://www.w3.org/TR/css-flexbox-1/#flex-baselines">
   <link rel="match" href="flexbox-baseline-align-self-baseline-vert-1-ref.html">
   <meta charset="utf-8">
   <link rel="stylesheet" type="text/css" href="support/ahem.css" />

layout/reftests/w3c-css/submitted/flexbox/flexbox-baseline-empty-1a.html

@@ -16,7 +16,7 @@
 <head>
   <title>CSS Test: Testing the baseline of an empty horizontal flex container</title>
   <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com">
-  <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#flex-baselines">
+  <link rel="help" href="http://www.w3.org/TR/css-flexbox-1/#flex-baselines">
   <link rel="match" href="flexbox-baseline-empty-1-ref.html">
   <meta charset="utf-8">
   <link rel="stylesheet" type="text/css" href="support/ahem.css" />

layout/reftests/w3c-css/submitted/flexbox/flexbox-baseline-empty-1b.html

@@ -16,7 +16,7 @@
 <head>
   <title>CSS Test: Testing the baseline of an empty vertical flex container</title>
   <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com">
-  <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#flex-baselines">
+  <link rel="help" href="http://www.w3.org/TR/css-flexbox-1/#flex-baselines">
   <link rel="match" href="flexbox-baseline-empty-1-ref.html">
   <meta charset="utf-8">
   <link rel="stylesheet" type="text/css" href="support/ahem.css" />

layout/reftests/w3c-css/submitted/flexbox/flexbox-baseline-multi-item-horiz-1.html

@@ -15,7 +15,7 @@
 <head>
   <title>CSS Test: Testing the baseline of a horizontal flex container whose flex items are not baseline-aligned</title>
   <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com">
-  <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#flex-baselines">
+  <link rel="help" href="http://www.w3.org/TR/css-flexbox-1/#flex-baselines">
   <link rel="match" href="flexbox-baseline-multi-item-horiz-1-ref.html">
   <meta charset="utf-8">
   <style>

layout/reftests/w3c-css/submitted/flexbox/flexbox-baseline-multi-item-vert-1.html

@@ -15,7 +15,7 @@
 <head>
   <title>CSS Test: Testing the baseline of a vertical flex container whose flex items are not baseline-aligned</title>
   <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com">
-  <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#flex-baselines">
+  <link rel="help" href="http://www.w3.org/TR/css-flexbox-1/#flex-baselines">
   <link rel="match" href="flexbox-baseline-multi-item-vert-1-ref.html">
   <meta charset="utf-8">
   <link rel="stylesheet" type="text/css" href="support/ahem.css" />

layout/reftests/w3c-css/submitted/flexbox/flexbox-baseline-multi-line-horiz-1.html

@@ -16,7 +16,7 @@
 <head>
   <title>CSS Test: Testing the baseline of a horizontal flex container with multiple flex lines</title>
   <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com">
-  <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#flex-baselines">
+  <link rel="help" href="http://www.w3.org/TR/css-flexbox-1/#flex-baselines">
   <link rel="match" href="flexbox-baseline-multi-line-horiz-1-ref.html">
   <meta charset="utf-8">
   <style>